3f630ef0878318fb6d59cdc1b3c968834931c9ca8559b61f90603d5ce9312185

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe
Size 78KB
Sample240417-1dgrmsfh5v
SHA256 3f630ef0878318fb6d59cdc1b3c968834931c9ca8559b61f90603d5ce9312185
MD5 f69dba19fb1fd35c962dd7f93c428b9f
SHA1 ae5a8e172db617861bc41eaa8519968edcbda77c
SHA512 5d6e286b1b1ebbbc212b7be2a7507768f724d1a5b65f1a11143995379554985d0ebf312009d9f210f10290ec1a437dbb5a585e88717e06b63a846ed282524fb1
SSDEEP 1536:8Dy5rXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96GG9/dY1jE:+y5rSyRxvY3md+dWWZyA9/j
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
2416	msedge.exe
2416	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2416	1936	f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe	91
PID 1936 wrote to memory of 2416	1936	f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe	91
PID 2416 wrote to memory of 404	2416	msedge.exe	92
PID 2416 wrote to memory of 404	2416	msedge.exe	92
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 3280	2416	msedge.exe	93
PID 2416 wrote to memory of 4288	2416	msedge.exe	94
PID 2416 wrote to memory of 4288	2416	msedge.exe	94
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95
PID 2416 wrote to memory of 2212	2416	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff6b3c46f8,0x7fff6b3c4708,0x7fff6b3c4718
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
    3⤵
    PID:2036
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
    3⤵
    PID:596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
    3⤵
    PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9949638060649186275,13669492219791980635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f69dba19fb1fd35c962dd7f93c428b9f_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6b3c46f8,0x7fff6b3c4708,0x7fff6b3c4718
    3⤵
    PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9
MD5 5e2f0fe48e7ee1aad1c24db5c01c354a
SHA1 5bfeb862e107dd290d87385dc9369bd7a1006b36
SHA512 140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2
MD5 7e0880992c640aca08737893588a0010
SHA1 6ceec5cb125a52751de8aeda4bab7112f68ae0fe
SHA512 52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5c783ba838b3181e7ba3992ce5fba6c768e97f3163c0e9a50e3badb7b051bce6
MD5 b83ceed9dca29a46d6de8591f2b3260e
SHA1 61c1ec55cb1b66c6473d1dfe98c3434447fe2194
SHA512 24f8d0e030b1884cb820da768f541b68762c85e842ce611d0060e654dae175be81af70a445d257e50a03add41357b880a1e80c94e931bbeb9346067d206cfb7f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 93229cbdbad260b718fdc00200b7c68e21c6eba06118eb1ee4f29ef94fe51dca
MD5 e975b632ad567b9ee68fbc07648b1fa6
SHA1 dc8c2baf130b38a66ffde278668197313617babe
SHA512 2a04d13e036873c259b88f19f88ccd1f90e05ccec1566e9ad78983047ec8f568e5eca8a865cd88d3ac8b302fb42bd1e01513cecd7fce4e0cdc54205334e5c08a
SSDEEP 96:nBAkyNtt1X4hrCwpvWMoiVmdeHahJ/UWQyV+VDCziEwb:nBAkyVxkCGWMXe/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 44b5418ea459bbd86c820c22d72d019c229baff9cf9d933166c031347751cea6
MD5 e667b08bd2cdf3e44b833f11227c07a8
SHA1 0c124bd22de688c008a125c68c14bca2f07c75d7
SHA512 8bb74fb3794ddc34f8da1ca9f8fe4a0bb6f9bb364e394a578ca2beb79886be7b56772fdd15b021d0d67c14933c675a5f907da3fa059ff6579fb3c203045e409a
SSDEEP 96:nBAkyNtt17hhrCwpvWMoiVmde10Y9MkdfvpdJFJIUWQyV+VD7AiEwb:nBAkyVxbCGWMGY9BX9Irg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 817a0318a72e5c04e45506d03e6cd4452cb3a087144b4175bbbfec10b9a30ffb
MD5 bc3aaf230710a082797721c6334cddf9
SHA1 2b43100769614e21b6b67e7e20e2e1527fac1a58
SHA512 859bc29d8f0eec5ae563261006b19703785fad6822d62322da34a38fb04d32e31cc7b7ff6535987c2dc2f801634fcdf9aff72cfa23e79232ddf8fa0d653d918b
SSDEEP 96:nBAkyNtt1XohrCwpvWMoiVmde1Auz1jaHJ/UWQyV+VD7AiEwb:nBAkyVxUCGWM+uzha/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 2102cecc99b51fd06425c8276d054daea9a8658577c00846fe4325338f0939b4
MD5 b23d22a6417205c108c4baebd8d850c2
SHA1 a66df0e79236201d9a6ebb298c4d8fd27fe176dd
SHA512 8db0c4ba70b6a28449c7e66f132a02c94b3d2194a5ed3ef3de870a038d6e4351ec60f48a4ac52be100ad8d930365f4edb1cbe983d577200959ef05b0fbb3171e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 564b6ce0e6a97ab235b5e6fa9529a0b78705c325261927e272af1afa96f18d6e
MD5 ee07aacd810b62e39de1f2b5ec44e81e
SHA1 118d5913c20764cf01151027d86afcfc6cdadfef
SHA512 d7318f0f4ae39f66711df60a09451e5cad9f4a9431508d2b8fab2b2c6814fcea2318cb04520a9929001304f42959f7528b2508b70180cb7c0eb272823f85261a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c0c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c0c0.TMP
Size 371B
SHA256 0246d67ae2d627ca082618c55b85df2b5cf8dc380e7b88e183f081eb6c5a4305
MD5 29675f00726383d788137c30acf34487
SHA1 8569f41f4d2c4236e8269edd4693ea9b88d260c3
SHA512 13f4813bed0d93b0b8ea7c3e9996a033eef8d8c06b68ced56292148f32716b3a408029c7a3c9fdf20f277506a84f696b97930427b7c6dfad62b0d2dfcc3f0bdc
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f72f9a318ceeb61cc4a307ca47c1789709dc37162aa33a3738cd1aea20328c6d
MD5 1bb42276459fda88936e25fcf044625a
SHA1 e0d18ea4ee021462d9f3eef9da69c1dc6ccbc880
SHA512 b7b9ca231f2128b42b3582eecd8860ce6ece517e3ba4d05e11d7d68cb26ca7af158225dd7ec7fbd59cb79d48cbc00ce8bf7e81b2e2117c600f5b0f9b2b402987
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj2bre2RUMZwYdP4M+olzOk:A9iIxuERzA83h09RZxYj2/MAAKO4U07
MD5 SHA1 SHA512 SSDEEP

Submit Download