dd611c835e0151b3d6506938243ea5cc0327131ea9c7bb2d3a460eb48baf0e84

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa4dd4ad7f68981b8216dfc4443a32bf_JaffaCakes118.html
Size 125KB
Sample240404-ab5skshc37
SHA256 dd611c835e0151b3d6506938243ea5cc0327131ea9c7bb2d3a460eb48baf0e84
MD5 aa4dd4ad7f68981b8216dfc4443a32bf
SHA1 17f75991da889013c2fbb8bda471c01fa89369d7
SHA512 8c54353ceec11cadeb08c465e4df3f61180d15acefbe9d14fa94e1066c17bd69c112ac0003a9ab96f4b239dc1f22b47d55461bdc1f3b7f427b28eddf08d544fe
SSDEEP 3072:9BxDAGXmNJUzmZeD+Zu+0FriKPHPqZ992WN37mo24W95MSFsI:jXmNJKiK3qZ99bNc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
4504	msedge.exe
4504	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2936	4504	msedge.exe	84
PID 4504 wrote to memory of 2936	4504	msedge.exe	84
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2508	4504	msedge.exe	85
PID 4504 wrote to memory of 2324	4504	msedge.exe	86
PID 4504 wrote to memory of 2324	4504	msedge.exe	86
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87
PID 4504 wrote to memory of 3800	4504	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa4dd4ad7f68981b8216dfc4443a32bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb123146f8,0x7ffb12314708,0x7ffb12314718
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3840694963092107454,13590368084558933492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
MD5 e494d16e4b331d7fc483b3ae3b2e0973
SHA1 d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA512 016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
MD5 0764f5481d3c05f5d391a36463484b49
SHA1 2c96194f04e768ac9d7134bc242808e4d8aeb149
SHA512 a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
MD5 SHA1 SHA512

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Size 20KB
SHA256 1cbc3547219f57ad6c23de13f412c8ee76ab28641ea6c1725061333962b6f088
MD5 397892797fc3a893d689821353364e0a
SHA1 a007426bdbd5acf849a6f3ba07f50f11efe122e1
SHA512 082cc29b400a5c0c9cb287d82ea8ceac1592656e585c4d6618770a511a5623a161f885dcf80c78e4ee0d37b56ee0f7da8fe983d3c54cfce6b397af8d953eae51
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHoz7E:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+o0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 3b548c637db2a519c4379172e7c3478b88aaeccaa0454798945c2cc48ec3eb06
MD5 97de3c19ad7861df599e1c9830f3b199
SHA1 1b0702c1350f87e40a34dfa790b9572dc016851c
SHA512 6e6f71e882ddcad38adaab239012ede0264c1fabfb743f44a96c37c8d41f379ca277571b1a2909c9dd70b97056aab22e88d129939faa526bd1c80240e281509d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 473135dd0c8eb905f42ee6f5913695caf814f4c65ac0e9b12f85e852fc0da313
MD5 dabbe1d619b462d4b01cba60593f2a0d
SHA1 8acb20aba0d7222c989843a38058d2fe23f1c527
SHA512 18a8069201bf65e91cbcaa7e6570dbfbbeda7910f7762d170e7bc655e8730d5c6b749ddef25f7c02f4e770e7a71dcc04cbb031f94e4c1c070e52e604d1f89750
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8794d12132751fc5d3cf533b522f76cc9837a4a7cec25fb68afe9826150ca544
MD5 e212a702a72ca3171a6f7889b7de44ef
SHA1 6ebb93515f608a9410bcafab39bd4e05b67d983d
SHA512 58d9b5aee7e1bb7074f1a57c7dcffcb804d658cd8888744b0470cf5649eabb62cc23b2a96192d8c710ae1738246aa9becc6cdcd71d540cab795cb8ab17bb68eb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 dddc6d6bd28e2632b4bdcd0d9b1d166d4a7c151567430e56dd4d287dd35b35a1
MD5 4f9aed94554b3b05d3d4bb78ccc49bc9
SHA1 838d2495653f644728f30f14c881821fc3c68c94
SHA512 304e5359be8588b596ca49e70a35fa26806e553e49ef9bac69d05cd8615ca99c492206968f1693c88453ebaf4ff96e0d863614b2b92d2355077088dd0a527d13
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c8db3e630d2c6766946fc5f49ddec0ce51fec7078bd5bbcafd72ae47225e534e
MD5 79eb79fd96b98ca4be86a30f05cee520
SHA1 a359ceb96bfd71831b4115dc3268934afa3a176c
SHA512 7536e3e63b30fa313abf2d590c6a8ce699747d1252e21532dc357c64d6a59d99e017f77f2baaf89a43c3c1199f5f50d7250baf021ba4665c87717e672eaea04b
SSDEEP 96:n/ko51+sB9jawpvWMoiVmdeHbe/fUWQyV+VD7ziEwb:n/kYd/aGWMXwfrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 38fe817eb0bc4ddb1daee83d8bc7c032b56364a6d17a6c7558c8954f057f3b6a
MD5 612d71653e5d0676f115ad0dc3bbbab2
SHA1 57a4cae5dac79ba1800a44f85a7abe28f81cf972
SHA512 95e6ed810260a8d6e9bb39defdaee83e7fab0f7ab8815e87d52d6ab7d527f35375000b4df8e84dee4c177e33b6791fd276bb8bb7d7640499c2144fa0d65c760f
SSDEEP 96:n/kD51+sB9jawpvWMoiVmdeCN4ftx22be/fUWQyV+VD7AiEwb:n/kVd/aGWMSN4ftx22wfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b0e87a5c937e8529019ce6afd6778ba22dbd393d98f944e98c030ea08cd7e278
MD5 9097d04af10e8e32aa02381a2156f2ee
SHA1 5053083ae33e82b37f100620f1ee6c2f21c4d550
SHA512 69a785d2f153043ed5649d75580e2d3098450084983a5a8f5fa07e366304474328578ab04b56c378c6c4bbd9e8cf5a820eb01178fe583ed11c344e52c570474a
SSDEEP 96:n/k/51+sB9jawpvWMoiVmdeCN4ftxVI422be/fUWQyV+VD7AiEwb:n/khd/aGWMSN4ftxVI422wfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dbcd4964bfc00a988a5bd770cffe6a5e379ec99c6905cd653b7b6de10215dcaf
MD5 2ec978dfa44519c1331cd1a281649734
SHA1 6584db2ae1c9222137f511ab92dfeed2f4fb9d22
SHA512 0493e7e5a7b781320a881257737426a5ff0d81b8a65894fd8ed944db71e218e69e22d74b2f37ca806847ad4e9b7ca9a378453922b54c733c7eefe26d45cf3035
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVf5Ae2RU/Flb8rGjKFGOzq:A9iIxuERzA83h09RZxYVfEZriMJzV+/
MD5 SHA1 SHA512 SSDEEP

Submit Download