77fa897e51397b3582f3596714e20e6bcd1afdebefba59936bcbcaa7925c6c23

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/03/2024, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
41be1a23ffb8f2890d867c4b5e6bb804_JaffaCakes118.html
Size 174KB
Sample240330-xalpmscf49
SHA256 77fa897e51397b3582f3596714e20e6bcd1afdebefba59936bcbcaa7925c6c23
MD5 41be1a23ffb8f2890d867c4b5e6bb804
SHA1 ccfb16e4411bfd3c63df1a1cccebaf2a679e4d4b
SHA512 146c7baed093e2e8e16f8b554cc75cd725431bc61d77fa51b758c498a1e1f2988e42d03cfd871496255ead21b4b11631df524781b0c1a150b90617a810897474
SSDEEP 3072:nqRcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/HDYlY983S9+mf:6cjJ/jXmNRG
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
5044	msedge.exe
5044	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 1556	5044	msedge.exe	85
PID 5044 wrote to memory of 1556	5044	msedge.exe	85
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 2752	5044	msedge.exe	86
PID 5044 wrote to memory of 3168	5044	msedge.exe	87
PID 5044 wrote to memory of 3168	5044	msedge.exe	87
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88
PID 5044 wrote to memory of 1112	5044	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41be1a23ffb8f2890d867c4b5e6bb804_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe221b46f8,0x7ffe221b4708,0x7ffe221b4718
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18437434448220598673,10507826439436971428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
MD5 4d6e17218d9a99976d1a14c6f6944c96
SHA1 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA512 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 20KB
SHA256 1cbc3547219f57ad6c23de13f412c8ee76ab28641ea6c1725061333962b6f088
MD5 397892797fc3a893d689821353364e0a
SHA1 a007426bdbd5acf849a6f3ba07f50f11efe122e1
SHA512 082cc29b400a5c0c9cb287d82ea8ceac1592656e585c4d6618770a511a5623a161f885dcf80c78e4ee0d37b56ee0f7da8fe983d3c54cfce6b397af8d953eae51
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHoz7E:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+o0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 549ad96f3a39d1fef7cd5ea2185458fc7b66921241ac75d0a89cdc30e124e180
MD5 8eae22ea98ed4f9525d36c402f71fb8a
SHA1 23b834e061a27267113179b62949d7106b998324
SHA512 f58342209af0fdfd05e9d9cbbc99da1c0648f5e06f7f1d153e31467ddf1738c760be28addfc8ad5752736e957bcd73694f7c672ce16b33836fb09c7742116875
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 55c82184489a9692dc600c41427f6ac009a45db9a6c9d662f095353d8ff868f0
MD5 ba12d31514a1c0e3f2050e3720cdb92e
SHA1 7702a06f50ab169f4aadfb7fd652c33b62f06b19
SHA512 66bb5fe53769adb920927b20a1185ff373c8b9a4efe85b1ff281250fdc2c605a8bf343d9a6059ebd7aee5ba21ec5702aee7460a3ab8f3a0c5c67243754746e88
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 49c749f3fa93b152b5bc347a83f0d22786181609b8fb2e7463f40fe2b0cde390
MD5 8d7fe75e6d6d084ee7f18ecb9fe0a420
SHA1 43b4fce46e4ddfe0408ec8d2d952b3077fd2eba6
SHA512 6dd48d6d9e79d78487f805dd3accc3230d300956ec0821de5b64757f8a3c10eba1bb2dcc371c7c8035d8b010cc913989ba2a78beb4588b6517d89b75b1b7806f
SSDEEP 96:kjbFfx6rF0+cFGdNEoGsGpGUGsBGNGSGDbMGWwbAG5+:kjbFfx6rFRcF1oxCNb4/ebM/8A1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 41b4381a2633b1aa71f4266e12d019f25133fa95f665b4f71e3619caea89a0dd
MD5 649006fa381acb5153c29e8bd3dbd88e
SHA1 4058f7d19e461e64d974c9bb2ed08ccfad9ddce9
SHA512 5525ac4e7e301cc7807d8e96b93d40250fc29187e141851a3d38f684c7e16f9263769dab3ff24ff6d5fae12fc44b3480b9dd3afd6e27e4dbc62dc9032255b4d2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 50d10f058beb3ba4acaf4c1c62e8961a5018eb0bb14cf266a0112cf59fa9f7e3
MD5 097b4e39582ee02250fda4358805f7ca
SHA1 c017eeae75b3da3b2243f35bd56dc43cdd49fcac
SHA512 25bd272531633bb632a082db15b163cce84c32d2b8101d3272c50f656f862c1cc80cc3b0bf6598fe3f1adcd6ad25b8513519ac44f77e2b2ab06f5a0877e63537
SSDEEP 192:nekiWJGWMmD3Nw48jbkMqtErxwVMB2P7rV:ne3WsWAhrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9819b1642485c175c7ecd3fe5faff3bf05926c1775053bb762f263c7dc7db3dd
MD5 85a4cad9f7af7eb7db47a580f38d1ddf
SHA1 ceba74a0209437a94220f95ab816393319cada58
SHA512 f01d740885e5fdd12b0f90cc6696914b1c9409d661a0223f17cf898b219cd83e45003d40af57fd33d9aa8e33639f12431237c28fdf03c0f2bfdff1fb9de0250f
SSDEEP 96:nskBf10h3wpvWMoiVmdeHPYoUWQyV+VDCzia:nsk5W5GWMXPzrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 665b147fe7b04e5c8cfab2339dea35e282885255e28bd43b4c74f58a27152504
MD5 7d94c292afd9d97dd3cc1247ee80ed4c
SHA1 d171165419f87ff8adf3cb91c1cfb02cad29086b
SHA512 600b4d28c6b42952cbf09bcb6065dd1c8baf9973f80c2c4e537509451a22cc5dcc71fc1047255041793a5d4dcdcd3be38c3dd95060ce060aa2c8bf2fbaf9b62c
SSDEEP 192:nekqWJGWMmD3Nw48jbkMqItErxVnwVMB2P7rg:neLWsWAKrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
MD5 c2ef1d773c3f6f230cedf469f7e34059
SHA1 e410764405adcfead3338c8d0b29371fd1a3f292
SHA512 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
SSDEEP 768:nFeW8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLl+YrU7C:nFeW8ou1jaTLI7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9ff684a822a44913a97e5efbac79654ab0c31c95b579a5abe551d464d94e417a
MD5 9daf2ed67d08f6eafe7280d10ce47dbc
SHA1 a44d73bbfcc2a5bbb05ee0b57ddf5e17e55ce850
SHA512 8534db5e629a149945d042d64e9b095170ba33ed93af8e5f98d5780ee45fe10c37e275d89c4895fabb933620ffb3bf52ca58959777d825bd3c3c2de74562c1d1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/e2RU5vs9znIYWLSDgScKA:A9iIxuERzA83h09RZxYHr9zIDG8D
MD5 SHA1 SHA512 SSDEEP

Submit Download