c08c76f0a731923cc62cdff3ab956e867720fd562b1b3f8a421f214921c6d4c0

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe
Size 78KB
Sample240420-3patksda98
SHA256 c08c76f0a731923cc62cdff3ab956e867720fd562b1b3f8a421f214921c6d4c0
MD5 fdec234ed304f0716d59f0121fb48802
SHA1 a685b861c88596b2f243fbccda7e04ec18c402f6
SHA512 1adc43a7d3893d0cf4beb4e1b6e838ad312a829c525f0163bc4a30e8fa6cdad57fbd0df5de5dad7d118ddb99186952e1db145d7951d4c5481a304fb0c139744c
SSDEEP 1536:4WtHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtL8e9/2V:4WtHFo8dSE2EwR4uY41HyvYL8e9/c
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
1636	msedge.exe
1636	msedge.exe
2000	identity_helper.exe
2000	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1636	2376	fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe	88
PID 2376 wrote to memory of 1636	2376	fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe	88
PID 1636 wrote to memory of 1804	1636	msedge.exe	89
PID 1636 wrote to memory of 1804	1636	msedge.exe	89
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 4944	1636	msedge.exe	90
PID 1636 wrote to memory of 388	1636	msedge.exe	91
PID 1636 wrote to memory of 388	1636	msedge.exe	91
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92
PID 1636 wrote to memory of 1440	1636	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x84,0x108,0x7ffdd1bb46f8,0x7ffdd1bb4708,0x7ffdd1bb4718
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:1508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    PID:968
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
    3⤵
    PID:5440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11722725095671493702,5344103215630650933,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2720 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fdec234ed304f0716d59f0121fb48802_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd1bb46f8,0x7ffdd1bb4708,0x7ffdd1bb4718
    3⤵
    PID:5376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929
MD5 7b56675b54840d86d49bde5a1ff8af6a
SHA1 fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811
SHA512 11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775
MD5 48cff1baabb24706967de3b0d6869906
SHA1 b0cd54f587cd4c88e60556347930cb76991e6734
SHA512 fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6
MD5 SHA1 SHA512

Submit Download

8075a5de-66df-4692-939c-05d16bd796e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8075a5de-66df-4692-939c-05d16bd796e5.tmp
Size 6KB
SHA256 3476b775360e156bfd6fd62bf922ad910cd7bb7f4707fd6b2e629deb16a185e4
MD5 e717aba7e50c3c0976313e3aa7e74616
SHA1 2fc3c5db3d913ceefc440ab22e8e4edc7fe463fe
SHA512 c655ac0d09d6cf8df5f9c127bd4a2b839cba3749334a81d00715ceb5cc696dff6fbcb967c00ba00d89e60f37d51b19298be35386c6140304b70dfb11411d7eb4
SSDEEP 96:ntQksvxm/Ynmq9I1nts5wpvWMoiVmde1ZYCMkdfBpcV+dwUWQyV+VD7AiEwb:ntQksEnCIbs5GWMDYCBJDdwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 1a64c5f00449e20ca93edc0459b1a0229429a39d7ba6402655f0566660e032a8
MD5 5dacee4899aed255ff36a781ce73776d
SHA1 4364f2d8c43dd5c4b25a3beda60c618511488d4d
SHA512 0556fe87a4d4cc0ed45157251c91c09da54a86f9621853b9488acc6eda01774cc05cd07326c42a0f327957c132a95eb909e9407a9b001f8b78e77ad5aec8cfc2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c08ef1b41310556d7a475dffaf607244eb401f5d71946c432166ebeaba74e36b
MD5 7e9cc7a3dac7f980ca79c0011de04dae
SHA1 dd14f44777be93f74786fcdbe202c3d3fc153f5e
SHA512 7ac088fedbae1efb1d791e97ba3eacf89a5d025d914246aee2e6d9fc66d319809a3c535b7e6499fa74ab115bc6345df7f8086fa96b8769049bd6334b11262a8d
SSDEEP 96:ntQksvxm/YQYmq9I1nlX5wpvWMoiVmdeHXI+dtUWQyV+VDCziEwb:ntQksE9CI3X5GWMXLdtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1bdc5dd2d4b7ab9dd1c042059f29dc119c11e7e3cccf1d599c49193cb694d514
MD5 ead2f89c78d8cdbf04b9288097b7d146
SHA1 268eeca2bddd1479856d58c7b7e7053600cfdeb3
SHA512 9213a6480548e89138b63a8c8372282977bc1098154ebcb8f919be2b693065dd642833dfb95152039153293f956a1746ccb83136baaabb0519ed30c5ce1cf667
SSDEEP 96:ntQksvxm/Ynmq9I1nlf5wpvWMoiVmde1LduV31jX8++dtUWQyV+VD7AiEwb:ntQksEnCI3f5GWMPuxh4dtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 48ee5f2583db8006856de8460784f7c817a425970d9981b59c55e32bfc07c286
MD5 cddaf9399eeca4cffced75f45a1b36d1
SHA1 6676b68c9d2499959aa831db8c081191750e0092
SHA512 f3bf44750931a54393e5cef760893510b9528839a4978b0558593c014332b828746e9f6eeb2ab76e4bb96d44a86ff117503cfa1f8ec328d8fa18f974b41578b7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a2a8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a2a8.TMP
Size 371B
SHA256 57f38a257be4fba5784460b87c1dcea9241a1713745a5c0cfe1776b303de5246
MD5 70ec7ffa94c44ee864ffc3f756fa5304
SHA1 584d13360ddc58404d51dbc9dfe74cbbf3b212ab
SHA512 f2e39c6d6f8e12b8a1d04a0c5c2083ec087b246e1bb57633de945ab0ef8a248c4ece3c8411f10984dfdb2b5d29977a10fc20a83be232fbeab26c609a060c1ea7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0120dfb24a2e7987ed2d6ccd34486781a2617235429dd59f4ed62be07fca3f79
MD5 33f9f95df48cf768e1ce49d23730cc99
SHA1 5ac33824701a976ba223bbb44caca520c321e3e2
SHA512 d7e6c45154d5cbe57dcb3d5cb98a7f862da4c2087090fd917b9f8f397173e8c41c8e31656b8000230048c83188b9ac6a1c90b78feb4a2a69131289c791bfa502
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupExe2RUzJbY91QdP4M+olz0:A9iIxuERzA83h09RZxYElExg4AKO4Um+
MD5 SHA1 SHA512 SSDEEP

Submit Download