397bbbbbcf5c97a5c9ce31ae4f13a485457f4391cb2c5a827ae614c17555b18e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe
Size 228KB
Sample240921-mcbbksxbmf
SHA256 397bbbbbcf5c97a5c9ce31ae4f13a485457f4391cb2c5a827ae614c17555b18e
MD5 ef949568805205d59956f6f00dfef2a8
SHA1 927a976e4cff2a920d69d405846c51a22be0d57b
SHA512 143642266a3b249a56317ad26f681324e303ab9bdaf032a3e4e682c879279dbe34ddf6b0dec9d111d674372a09ffb63d7941cb44f440d62924534e2ae6f16b30
SSDEEP 6144:NaCJya3zHD3pglzwTevRCcd6bUfFdXThU:NaCJy+z9glzq3wPXK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5096	msedge.exe
5096	msedge.exe
3020	msedge.exe
3020	msedge.exe
1312	identity_helper.exe
1312	identity_helper.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3020	3628	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe	86
PID 3628 wrote to memory of 3020	3628	ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe	86
PID 3020 wrote to memory of 1524	3020	msedge.exe	87
PID 3020 wrote to memory of 1524	3020	msedge.exe	87
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 3460	3020	msedge.exe	88
PID 3020 wrote to memory of 5096	3020	msedge.exe	89
PID 3020 wrote to memory of 5096	3020	msedge.exe	89
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90
PID 3020 wrote to memory of 1428	3020	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7fff6cf346f8,0x7fff6cf34708,0x7fff6cf34718
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
    3⤵
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:2360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6142299742031036254,9219513015534342866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ef949568805205d59956f6f00dfef2a8_JaffaCakes118.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6cf346f8,0x7fff6cf34708,0x7fff6cf34718
    3⤵
    PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7e7ee0297d45940c481f7b1a862431d80ef80917a2f446183348f78eab3468a5
MD5 90b7ecc7ca3f8e7e5602834db2516804
SHA1 3136f3e93419f1bf0b56a47ad9a8417586aeffb9
SHA512 03b1a10cd9570edfe7d63fd92fbab9e2661907019289db1ebf2d89636fa54620088c9fc1a6bf6292f090c2c39197034fa7c15fe06afdc3fd45eb8c7d3bcdc931
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e17cf9803582febf11cd5c748d618d8d2692e564d06a567a00102a8ab9976598
MD5 5a567ba9a3625312881e8f4e55349fb2
SHA1 bd13ba86122322f692145cde964ba2cfa2fe8489
SHA512 9d7961d3d8f4608de40d633f913a14191d135a504d1b2d26f2ad8429fb2616aee89a5b66facb3c1bbff48826ac68665bd3f6059b6ddbe9396ee4e4079da79734
SSDEEP 96:nQkRhl1ENkbwpvWMoiVmdeH2FFUWQyV+VDCziEwb:nQkRDqN8GWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c3e0da001ed382a79e8585ca0097a0888128af82cd878a09fa59c0f5153f30b1
MD5 3490071b2b4903ad55fdc70a644eb9fc
SHA1 56b20ace99c51670e2f644def89f255801f8483d
SHA512 6507113cc3b150f7056632d37d6f4f77f85ed6b5c9d4b4b23a36768e285fa2f2cceb2e452bb36a9115fd7f8c1102624f827abbb33b1c0e7e22fb552aa9e9c496
SSDEEP 96:nQkRMol1ENMbwpvWMoiVmde1Ou61j2VFUWQyV+VDCAiEwb:nQkRbqNkGWMou6hsrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0dede13f40338d734a046a74811f933479970f0b534e5151a60cf745d86a4aa1
MD5 653a6a1c6d566127552762e7f5efec40
SHA1 45d72a59262b4c331c89c888c955ff3b4284d757
SHA512 0f259781aa2ea430784b1bcbef99d5a5905d0d91733a2d828862344c710fd090e58694d0afb5ada66a91b19ced53b5aee9bf2d856f0b7944298b0445cea26482
SSDEEP 96:nQkRMDl1ENJbwpvWMoiVmde16Y0MkdfFpRJdUWQyV+VD7AiEwb:nQkRqqN5GWMQY0Bd/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 d54fc259d9276cc7405ed3d8129d0aecf040618d03240d3adde2a0e9ed1914a9
MD5 9d0e3b8f5029fd1d81b923e0d8d70713
SHA1 b9ebd4a722e8c84dd8d292a2f5ba5c681348a0bd
SHA512 78172ca97a47d71bb7701078a3fffc809cceef03faa3f3d97020501dd5eec8eb1b95e1a262f135ce662f1e080ad25879ad0fc4a21b38369a13148ab1791bca07
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5843bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5843bb.TMP
Size 371B
SHA256 8160040dd1156a9deaddea9f1f3a02a270d5420fe0a9f6d03e3c2b2626bd504f
MD5 39a59c6e5bd29c6e7310362649536fe0
SHA1 d7f83f7117a063241ce70c4a97a14a817638bb70
SHA512 32cdf21ae6f18c8c6877099f35e84fda8fe53ec4f5e9ddd6d6a13f5135b0938ba3ce7d067609179d005e961ebb6bafcea20c4cd4875489969820a6149d2c5ce6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5489f7ef71bd2b38ca6633f612c6af46c189656458bdf150db095dd9ac350fd9
MD5 02cb9e617424ad6c80947ffe1d4bb6b9
SHA1 79ab09f7944d65f692d2e1843072962d2ea22132
SHA512 9a11661f867b12cf1bf298cb384bc7eb8d642a940fb9fe3b59b77486f5e73a5b66595685b8f1193bf6e3c523f83e0049d28607715f37b888f79c4182a92f693e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSse2RUPd6uIcM/bo5ZxY:A9iIxuERzA83h09RZxY3RnqZxY
MD5 SHA1 SHA512 SSDEEP

Submit Download