8fc0ace0e6db37e8367ccdf96806f93cf2fb0f06acb4361d99e5b70e2d77e8ee

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe
Size 9KB
Sample240706-t7nnqavglp
SHA256 8fc0ace0e6db37e8367ccdf96806f93cf2fb0f06acb4361d99e5b70e2d77e8ee
MD5 28de5d7c45e620ecb537dd30222a3554
SHA1 b00556d7e68f4a1ba3a8e4348a3f946142a82971
SHA512 67b001ecb36fd4de492ef7dab9171766299cf3704cbe923faffbeb72fda2d1dba0caeb9343807c717779dd68bbd7d8f38239e33feab020702e655347aec5e1fd
SSDEEP 96:dqjc9O2hcVFyGtR0Q+wrbMmeUx9RfbW3/VPMtGLtdZerdMgeRNKD8EC:goA2M7tR0CVeERCt0cLwhMgeRNKDnC
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4636-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4636-225-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/memory/4636-262-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
1816	msedge.exe
1816	msedge.exe
4476	identity_helper.exe
4476	identity_helper.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe
836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4636	28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 1816	4636	28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe	86
PID 4636 wrote to memory of 1816	4636	28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe	86
PID 1816 wrote to memory of 2940	1816	msedge.exe	87
PID 1816 wrote to memory of 2940	1816	msedge.exe	87
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 5072	1816	msedge.exe	89
PID 1816 wrote to memory of 636	1816	msedge.exe	90
PID 1816 wrote to memory of 636	1816	msedge.exe	90
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91
PID 1816 wrote to memory of 3676	1816	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28de5d7c45e620ecb537dd30222a3554_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://voxcards.ig.com.br/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe777146f8,0x7ffe77714708,0x7ffe77714718
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:3140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
    3⤵
    PID:1936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16756685950664073241,2543684574782308742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5
MD5 210676dde5c0bd984dc057e2333e1075
SHA1 2d2f8c14ee48a2580f852db7ac605f81b5b1399a
SHA512 aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1
MD5 f4e6521c03f1bc16d91d99c059cc5424
SHA1 043665051c486192a6eefe6d0632cf34ae8e89ad
SHA512 0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 76KB
SHA256 8f2c773bcf8619dc80b4a7ad862eebd75f0056fca5773d3cc61518639ed81d54
MD5 1cb55c409de6c5aab988f51eddb6fdeb
SHA1 2c9deaff213932251b33da72885fb68ae864030f
SHA512 ee44f0455df592289fe6458038b731f3bd5ad1876fa1ec1972bebc16ecd669f131017a0c57a6a3c17fd1a69b99c630b0d19c91918981abe572f3c57adbb779bd
SSDEEP 1536:qcIgOCd4AZSyO2R9jlupBTRpEPal3trgp9AY2I0C5eMW3T:qn0FO2jjlu9R+PStoCFpxMW3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 520571270855287dc942338d0893aaa2c0353bfe17d40792d754d3718dc07611
MD5 71c5447deafa65128706f080bf5ad8e3
SHA1 8ade02b39dfb834702e62d9565985c689b6a5190
SHA512 556f54716259ba0a7c82e44a113e3abc7818c6fbf1969ec8b84dc14cf87b04af33c22a44fe0c6c79206588aa264b091c3da193630585658b236d6597bc038bd0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b437abfc457cdd9f7c49d06b5a7795a6fa2c0d08fc33e8d46ec8cc9f1c92edd5
MD5 cb3888bd42b676875a1e1c3a6b7c1493
SHA1 6c7875f08ca8428943b62f1d453c55523899d785
SHA512 008b0d83c4ca0ea924a35c69bbba53bd77e2ae059240f079c338be9344e40f7d8d4a6ab31707f706d87ecc10b8bfc9e8a426e74b74497e5dbf91c99121bb9c35
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 91f38f1f7b695d6ad1c8fff1ac3b21bb69d82a0ee06876b9be9c38a0cbb8a8e6
MD5 4036c48e0745de04c054099da72f4a92
SHA1 1c2e90880b99862f262fb4de06a0c0efa4551e2c
SHA512 346ad43c98f949875a6bdbed6d6764050b3a042094cb232db0c535b185c4e9c5c8ed10b5630432496ff8ff748d16e95153e3b483917d1f6f52203a903cea377b
SSDEEP 96:J66NUgFUabkJjct6VwakqIo+VofH6VFT5hMvolix6f9T7oNfihSaC9y1MNZYTVld:J66NJFUekJjct6Vwakq5++fH6Vt/Mwln
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 264bba13bdbeca1e85dcaf29b5eb78c6dd9329c0c53549adb4b9a1e2fe533fb1
MD5 18b5fab45c4cca4902ec5a331fb67e9f
SHA1 9463fa309e8f5bf39444ab86631b758f29113ffe
SHA512 32ba228d10517fd6bcc1c7e1b50fb5b1e4e94568ccf961fc61fe5f1b2468a157fac9bd9a15d0153f1b6bdb2b00cd7bbf3be99892148ba3610dba3e28f038424c
SSDEEP 96:nCkv71htFwpvWMoiVmdeH45x5fhUWQyV+VD7ziEwb:nCkjDXGWMX43rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d89f409aa9f8d6efe09f349e95d3f953cf60b6202c076df569485648a0bc0e91
MD5 c7e7e4f817852ed4d98813ca145d553a
SHA1 de82ab88b27c3db03e05eefbf336ce320e1d5a75
SHA512 bde93a9e19bcfdd589a6a13ead2b20dffcd61f20a2586e282fd5f10274c47f7b13d80a2cdfe1c9ed1fb6563aca528f251967118530b7d54f456a3c94c24d1d32
SSDEEP 192:nCk+D6zGWMluRBLJXtkHHkNkcb4qsG0OAluSSakbzOMmKV9fqEVCZ7BjMqnBqz2d:nCdD6iWzgEGIXjV4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 66d7733361197089c02aa9ac36121ecfd3f64d4948526ef24e0326cccaa9b9ef
MD5 0c3c8ac4d934e8497f9d4b9b2e2b77c1
SHA1 31ba4bb79c32efc506a784158e20eca2ce9944fc
SHA512 60b76d66a05ec67f1fea02bee9cdab07ad1a3eb590e4f3eb0a8e7ff12bc68dd73d0b59bac662f5df3d3552ff6fbb758ebb38bedc47828113aa528d299c2b1147
SSDEEP 192:nCkvfXGWMluR/EycRoo/LNLfJe93PnrhJ42RKHEwGQXFmtkLVCZkBnCXnBqM94fF:nCsf2WzEzxlUsV2TaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1e26d015a72c07888e0bcdf011f2438c3788ecaab99fe8d5da87ebbc28b7fc7d
MD5 4d0fd1a503dfc7c5bdd543fb98696e4a
SHA1 63ae83c9ae921e58ce6c0d4c622c23cea93df0dd
SHA512 44aa7a9990435d086432c50d0fc4c66a8b9d0b16e2afa3a7ca79bf9955911149fda3ced24affc3fbfe0553577d96a118fd73cef5a23535a739184824265db131
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5a00fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a00fb.TMP
Size 1KB
SHA256 945a045d4b0308178587caccc0181ea62c0b4b5e46d741a506d184e4a4d3d52a
MD5 7f45aed15436185ded6246a3f72679ba
SHA1 3e362eefd815c5f627231a4ff180d49653e43cc3
SHA512 fb3753d0867882015a407925aa890f8938b658a2188a3f5f476b22021b9f2215dec659798b898ddb12bb27ed6c3003a9472d077b514fc14b6d208b16d4051006
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 632edf5df66642ba67d4cc62954b13d6eff80fd7d2f65dcedcc2af53728e5c9d
MD5 656955d3aa72b793652b4cd824c4d8d2
SHA1 33491a87d272d20fcd7864da3d63544d00bb4205
SHA512 bb35964ef19c74c162234f0caad5aed226bbf3b7bc109c9f951e3b88ab8a13fa27d891cf31bca5b65b83c442f5e7a1597801f8328076f0b49a34bc7ccd37e9c6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupmBHe2RUhcSCyuSB6VD7PA8:A9iIxuERzA83h09RZxYiv2CyuU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4636-262-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4636-225-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/4636-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download