8f3e98171e6b081fed5eee8f7d2d6c9c5401f5248f444d836515c5d7d373fe84

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe
Size 78KB
Sample240418-2mfrdagh88
SHA256 8f3e98171e6b081fed5eee8f7d2d6c9c5401f5248f444d836515c5d7d373fe84
MD5 f8e88d350022e16072a436d11d74d9e9
SHA1 7d0e4773c165599da7ff5363417fc13b14d8d508
SHA512 d6ffe4cfa994308658b866c06fc127705fd029cbd1e26f028f9d841b1fabc40291ad139b5c3288fe69ab451dd5cbd9dd9f1fa406c7517d2b394de0f69adcf4d4
SSDEEP 1536:FnPWV5j/XT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQt96S9/uq1wg:ZPWV5jfSyRxvY3md+dWWZyB9/um
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
5024	msedge.exe
5024	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5024	552	f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe	92
PID 552 wrote to memory of 5024	552	f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe	92
PID 5024 wrote to memory of 2024	5024	msedge.exe	93
PID 5024 wrote to memory of 2024	5024	msedge.exe	93
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 3396	5024	msedge.exe	94
PID 5024 wrote to memory of 4020	5024	msedge.exe	95
PID 5024 wrote to memory of 4020	5024	msedge.exe	95
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96
PID 5024 wrote to memory of 1176	5024	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ffe473546f8,0x7ffe47354708,0x7ffe47354718
    3⤵
    PID:2024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
    3⤵
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6753539607882664179,17098391235160571206,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f8e88d350022e16072a436d11d74d9e9_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe473546f8,0x7ffe47354708,0x7ffe47354718
    3⤵
    PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9
MD5 5e2f0fe48e7ee1aad1c24db5c01c354a
SHA1 5bfeb862e107dd290d87385dc9369bd7a1006b36
SHA512 140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2
MD5 7e0880992c640aca08737893588a0010
SHA1 6ceec5cb125a52751de8aeda4bab7112f68ae0fe
SHA512 52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 943f15b8339fb40412f5610f06be6e42547d1bffa99feaa418af17c66cbddf72
MD5 20693d9ca642550b7b82517835d6d151
SHA1 f794304b641fee04827323e0b1cd27f03baf7432
SHA512 0b7dd0c28e4c4fd3120fbe6be576c94b99fbecf16d0a09f2ed98ef1387061c85d4e3384ad6df4d25978eba09244745e7bc239d882cb06bef52ab227da66cd620
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d0567e19282be8341c4aff29db6ae7d4c6e34681c98a65392dfb3a8b37475d97
MD5 baa2ecfbba6210663ccc4580f6880ba0
SHA1 af262b379ebf8e688011ded20eb44c533e59321a
SHA512 535fe1f508109cf53aaea0f0395329e6af05b110659c1a0057bc245f93a280afde0a91345d23c4337e2383c7f9f277a20d4719f9eb5c2d75c4eab15f87ac708e
SSDEEP 96:nLksvxm/YQYmqiEY1SkhrCwpvWMoiVmdeHahT1UWQyV+VDCziEwb:nLksE9B0YCGWMXA1ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c205775f0a3c9d75a6561aaa8c29e8ae981db6ee25ffaa52e67d10465c409d44
MD5 a60774f229376bcb4cbf0959a4329e8c
SHA1 0efcc21d34d74603f215507c0e2254a23f5a75d6
SHA512 a6200bab5bcd72338b179a6c17901f193d37115a4523937b8e07b98d0330670a131bd0d511369a49e4056c942422120ae025908f65e7f93de5038f4796be137f
SSDEEP 96:nLksvxm/YnmqiEY1y1hrCwpvWMoiVmde17ZYFMMkdfiZpdzSTAmUWQyV+VD7AiEc:nLksEnBQ3CGWM/YGBWAprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e295a5808b6078d86520f5ff48fbddbf1a8391243447646cf3defa0b21a8dd43
MD5 38cda657dcde61a53c1d9b5c46525b35
SHA1 f7ac30bda03f44066bee3f2649789bb66a91a80f
SHA512 32aef5a4f5c76b5b4e71e3de916904486a7adace28d5ed0426e02eb09590d24176a874103201bf857b9926980fa4f0ce6f55a018dd33aec7d4919b9ae9ab9994
SSDEEP 96:nLksvxm/YnmqiEY1S8hrCwpvWMoiVmde1JuF1jaKT1UWQyV+VD7AiEwb:nLksEnB0wCGWMHuFhb1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 48102b1380a68be720d4ead05c468bb4d6cd88c28e9e39a634523c04a3e48edb
MD5 91e4f364a54b6fbfa1ee8136307e0a5f
SHA1 7f327024f7bd2af7130e483d2cf9fdca7b5ed203
SHA512 a17c1f3c2230b7e4cd2ff38426e9a5ff11ff5c491121b61fa4e964469483696d401b80f024c94e241b57977457f35b12057a7446ddb289984660fa2e4dd8b624
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c851.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c851.TMP
Size 371B
SHA256 143222a1500e8afc5554618f82480d06e8cf81a5d4931132aa7db1f8935ddc85
MD5 d429064d68e395f046bfeebe13524769
SHA1 114912d4c429a836c45d0e3e9333f3db79ed7b97
SHA512 81a69ac242e8262cdf2684fab449a053626da82d02716b40af16026d041485268f27115af583abe3bbb928dee8420e18a65e0222ea23106198acff542e4eabf8
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7f328206430413b6fe956d4a75ef0f9d9ca1b43aa29dd662ca1308a1a2284609
MD5 83a013517318e14490a47ca8a06d914f
SHA1 ba952bacc7ea2ff914ec34861dc6a51c8fffd112
SHA512 8c12d3c090d62fa9f79717f355da7294598cb46d1e193f052445a5de41c1d56e69ae18eff051c498ab468e6ddb8393685aee9b54a47d24b041bd169890bf8d82
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPie2RUWZwZdP4M+olzO6ze:A9iIxuERzA83h09RZxYESfAKO4U/f
MD5 SHA1 SHA512 SSDEEP

Submit Download