a953b96b3a2a0e7a5f864dba710e7b27b4bcb4b938f314ee34ce42d1a023712f

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
Size

196KB
MD5

078e13b6f025ba620001b0e49b170157
SHA1

bfc3da294e06acebbbfbb67535600375f1ab321f
SHA256

a953b96b3a2a0e7a5f864dba710e7b27b4bcb4b938f314ee34ce42d1a023712f
SHA512

6c2f4c222699e6d4c5fdd328a5be97a68bffa3bf8e02bf154d86f9a09ce9e0702f1ec0aa32ab2f4a86a01dde7dbb1f6f5fbd3249ed2532e3834b6c855305d265
SSDEEP

3072:AQIURTXJWNrYp0nu1sWEJ01ZHoaYK+BzK94LH1pVFciChLsK7/hAS:Asshi0H6HjYK+lGi4hhF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3516	partner67.exe

Loads dropped DLL 32 IoCs

pid	Process
4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe
3516	partner67.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	partner67.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023479-64.dat	nsis_installer_1
behavioral2/files/0x0007000000023479-64.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3404	msedge.exe
3404	msedge.exe
2584	identity_helper.exe
2584	identity_helper.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3516	4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe	89
PID 4428 wrote to memory of 3516	4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe	89
PID 4428 wrote to memory of 3516	4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe	89
PID 4428 wrote to memory of 3404	4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe	90
PID 4428 wrote to memory of 3404	4428	078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe	90
PID 3404 wrote to memory of 1440	3404	msedge.exe	91
PID 3404 wrote to memory of 1440	3404	msedge.exe	91
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3120	3404	msedge.exe	92
PID 3404 wrote to memory of 3080	3404	msedge.exe	93
PID 3404 wrote to memory of 3080	3404	msedge.exe	93
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94
PID 3404 wrote to memory of 1280	3404	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\078e13b6f025ba620001b0e49b170157_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428
- \??\c:\Temp\partner67.exe
  "c:\\Temp\partner67.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.crazyloader.com/firststart.php?ll=YES&cl=1.1.7ll&p=CL&s=10229
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f28046f8,0x7ff8f2804708,0x7ff8f2804718
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
    3⤵
    PID:1564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1372 /prefetch:1
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13937427926974214462,15757925616718876964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\partner67.exe

Filesize
53KB

MD5
8f341587089816847049072f2f9f436f

SHA1
62b5142ef987ab18b0d9c8bda76defa4ba6fffaa

SHA256
23ef89b543c84c379975a044ae20b7b156cd74ab65875c0029b1a485927d1d7d

SHA512
59b79c09895edef799ed316b96935e2e48a2d464db0bc0c98df436f607cde0c4f7879fd60f3778ef06a09eaef723e73398ee128b3b628046f2a87031ed0e75bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c60ce113e84d040434200627ee7f43c0

SHA1
92107334379eecd4e17292a0c56e33ead4f79e7b

SHA256
7ec8ee21599014f84dffcb5c64063cc8824b15bdc2bb59ebb874d430a4744fc8

SHA512
5b240689969dcf506af6273af315a22b17b4426b23be2b1c63f0f9b2dc5c01d0d5d3bdc3dac49ae5d356ff09bdb899d1765b249859f0e0fa183a86e56fc444d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dcb8d58960e606260dac7fb3d321d8a8

SHA1
5d993dc8201c40a8d33569665ed4426961e638c8

SHA256
48797af802bdec0cf74186dc53f7aa4b5546a43cf602d60af7dd040cb1f51aee

SHA512
c34f991ed75f5368f7f35b6c1da3621956cb9588c709f39773ad618cb36a4286cd3e3514ac6186e5231b689d58c190674d1d4697b533eb216b172423dcb72e3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d3bf3b4f9ec5822cafeaea527c5c4c39

SHA1
472464a353a1378db5b362534b9b5c766f73682f

SHA256
1b5be21fd3a55b920d2505819b99d28d0b865b72c67462197d3759664ccc56a5

SHA512
e0f598a5e42f4abb4df009df4de31719e3f289dd39aff2790d20f1657e634dd441d33a5d7b6b388bf6f458cb4ccd48d3e8695da4a2e060eaadd6bc8eb2d5ddc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspDF16.tmp\Dialer.dll

Filesize
3KB

MD5
068ba6a2cece65f680895ea627f71e39

SHA1
27070d0fa949a80360426f37b3dfe9eaa0ed66f4

SHA256
ef649d2b3daed72b0778ab6b3f22a02e288fd009cf9e7e76eb1991451e580f82

SHA512
adf99b31790694d8ad02c56b1cb7c9dadeac49d492225a2d297654bfcd617f3afad23990d1d695fba03af1c355456e2e7c3e972eaa9b5ab1770bbb6eef0e733f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspDF16.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nspDF16.tmp\inetc.dll

Filesize
24KB

MD5
1efbbf5a54eb145a1a422046fd8dfb2c

SHA1
ec4efd0a95bb72fd4cf47423647e33e5a3fddf26

SHA256
983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341

SHA512
7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv94DF.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv94DF.tmp\NSISdl.dll

Filesize
14KB

MD5
88bbaee1059dcba83cce60777e90a423

SHA1
a0369b986bed181c9cbd70e573754d48f7930119

SHA256
19add6d77910f00709d52d1118765d9117246beb3d40ed227376e3a8380f8307

SHA512
9d6160ff34c6a7c9e91102374abd6611defc9588c7ce7dd8238d4023b2db79ff127aad9dbbffae68651de9e8206acced33b9960ca4a21eb7e6dcd6aa8c39c805

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv94DF.tmp\header.bmp

Filesize
90KB

MD5
43b68e1955b8d5eb71a5e115f1b70de4

SHA1
922ab5c260dc3925ec4440b5a86d43054c50f535

SHA256
33a94fd2aef8234dcf1c8ad996c617d0554cf968256849b965b16ba73e313c82

SHA512
77e6fd9a5c4352b8c6a257cb2bd0a149d0fbb7d0eed840f7d5905b3c2b41b737cc5eec3db739ccffb22e0f5a5c92c75214a6ff98d902d2c8bb923a8f4e1956c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv94DF.tmp\isWelcome.ini

Filesize
537B

MD5
3b7297f326ab2660d311dcd28c5051b0

SHA1
0fac16234dc00284b4158c199d3c43e028f55809

SHA256
86adc44a36669cbd9d401d3c5f344cb4abfee2a2a33d5fcf01ba59804cba24ac

SHA512
30cc162e86a2018e81e9b6215a5e903764005c6699c157513d963e0ab76ef9bcabb54c802db6f84d617bd831d721955391c99fbb6575d0cae58df566f9efe16f

Download Submit