76249376660d20978b2520b0b2f248a6251efe113552978133de07ee6c230d5d

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe
Size 4.0MB
Sample240409-vwp8vagh5w
SHA256 76249376660d20978b2520b0b2f248a6251efe113552978133de07ee6c230d5d
MD5 ea83125444f0793b4a4f111ac8579037
SHA1 f0c09b5088159238c2943f0dd4b4fb511bc22061
SHA512 1778b0cc46a9fd1cf0585d1e718ac9be0bb044f5941ec9539e0f21555dd9004250193c6c8f1f7f084bbeca7c23d962106b269e8c4cb51ac65ca19e062192b443
SSDEEP 6144:vxb4lxG83BGQFps74xdZL4Ego5ZyVWu356Ro/KL2P:vaG8h7WKZlZET56WKL
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5092	msedge.exe
5092	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5092	4796	ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe	92
PID 4796 wrote to memory of 5092	4796	ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe	92
PID 5092 wrote to memory of 2596	5092	msedge.exe	93
PID 5092 wrote to memory of 2596	5092	msedge.exe	93
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 4904	5092	msedge.exe	94
PID 5092 wrote to memory of 5108	5092	msedge.exe	95
PID 5092 wrote to memory of 5108	5092	msedge.exe	95
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96
PID 5092 wrote to memory of 648	5092	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8696046f8,0x7ff869604708,0x7ff869604718
    3⤵
    PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2661740863464802492,5337609454076987312,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ea83125444f0793b4a4f111ac8579037_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8696046f8,0x7ff869604708,0x7ff869604718
    3⤵
    PID:4288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
MD5 7c6136bc98a5aedca2ea3004e9fbe67d
SHA1 74318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA512 2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
MD5 5c6aef82e50d05ffc0cf52a6c6d69c91
SHA1 c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA512 77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 cbcb4ed99e5161c3f86d891298f2b376e1faa47bad89e8cba0c483c2e4aeaab1
MD5 922523df4bc6ddc9ad36b2c9a89ab847
SHA1 4859749dfaf216ec11f83ae9f1f5312a07ceba5c
SHA512 1ddd910545dcb4fdb0eca1797025c6e160b849da0834519ca9d6b304ceba8071e96a5d99ce49027427c85a05f6fcf992bfb6c8b6387102bdb2ceae34c4a3b8cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 71f2f2762c3f3e2769bab55883fb4fd90f01334a314cb42c92755849868ff217
MD5 44cf28b5fa205326a65723c51404c99a
SHA1 339e89d9292bb75fb869071cd52226bda7d4e2f3
SHA512 10e6a7426e4fd8547abbc491e3448a89b168b8503cf2fdb41222fd5fc0d102aca3fb265972382923f2124035c8bc2832119f2b5e7ccfc192bad2482a661d1ab3
SSDEEP 96:ntkJOb1VBxfDLJwpvWMoiVmde1cYFMkdfjp9Oy7UWQyV+VD7AiEwb:ntksBxbLJGWMeYFBbJ7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f006003c4a9255aea785084639c931d741c481b038d3184787f5e4c49ba1d62d
MD5 f8f137ca28bc00b57ecd0aa12c985ec1
SHA1 3f9a4589d3b3d2aa91acc4e6cc63941ce76bdf7e
SHA512 07f1f5a6a0582156c94b18fbd92ce439c474898bd2ca185a37d0a65047777a5f606067422d3c1f52e86ae9f2ac799c293e70fa136d29761434b7782352f54a16
SSDEEP 96:ntkJOb1VBxcDLJwpvWMoiVmde1Hu51jq1ylUWQyV+VD7AiEwb:ntksBx8LJGWMFu5h3lrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4554c311393762d86614dc7334cf8ab6ea7c760e61fa5d2d1c74adff50154a84
MD5 0fab6d6d15d9bbfac41322cf74ee5e24
SHA1 c7b7f64afd58ee6d3fd8e8eed572a5d7e37fc3e4
SHA512 b42dc0a3a6dbe10066413eacc537ed1cabf8fb4c291b2ce36c98acb2e96de059fd69baf029914092e3dd72dea58d589a3c298e15e3f1a9a89e3e00a9ec1a7895
SSDEEP 96:ntkyOb1VBxsDLJwpvWMoiVmdeHqqylUWQyV+VD7ziEwb:ntkNBxsLJGWMXYlrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 6e5d8794418838f8ba6b115849761d073de177c9ed47dbfe37e25febcd9b3b49
MD5 9c57c3173a44c08081c6b58b55046045
SHA1 f10ddf856132fc46c8b34f7d53e39acd7701b3a8
SHA512 a7473dcc0d35666a96959c67be9777977f0842b0d949def0b5705089018f1e439865fd7f86d658263e31ed6cd6bdda580900e6a4183679a1130ef8502baef749
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 9a897684f215490b200352b404ea50a75d2ade4ce5a43468c21519318af53b61
MD5 5fb43cc85b1992ef9cfcd1ad8e7681cd
SHA1 2ffc8f312e6301b1470734fc58b301a2350973ce
SHA512 34d61e6f6871662677c9b864374c62c6129c3d42fd32f8991b74bd2b1aea3e6daf8da9867ac4de375ec1b0640643578776bcea0022dca06e753e9e25ea79bc4b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ddbd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ddbd.TMP
Size 369B
SHA256 9bf5c5a7cde120417b4f281443c746a13e74f75413da7c1bad7827cf6d0ca943
MD5 a1c2371c5486814dbcaebfbb11e79416
SHA1 bcdbba6b96c84c35285a811de99f26fad1cf574d
SHA512 34f9002d2ad2af943e14d5c90f546efdf19e2701f9d38264896dc89e4d98c8493c4f9bfee5053e1fd2c0fa07a8aa41ace892405a459989c0b50771a0c8959603
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e3e378d47bf0dbbcd180276e16c78d82e31c8b4965eee0ad4ddd98740a1ea21f
MD5 b49285d8d644501117b21a362c66a514
SHA1 c988196d92a7dbc9f9393a70e4651592d8db662d
SHA512 3b92cb369627ec6bd3f20450575ea9d8efe9f740b11c56bd66292944be8b23b2940f656ca3a00aec12f46bb8b551a854e412298fe2c83792f7720d4187252422
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDLe2RUAqbfWxvFt2pTEEjI:A9iIxuERzA83h09RZxYPGWTt2h3Co4
MD5 SHA1 SHA512 SSDEEP

Submit Download