a999d2af67fdafa753d7554cf659dd7fd58b5e094119d9001e3b8d3fa7c7a882

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e39f0431f6dba204b308da61503eeef8_JaffaCakes118.html
Size 181KB
Sample240407-ah84ksfb3s
SHA256 a999d2af67fdafa753d7554cf659dd7fd58b5e094119d9001e3b8d3fa7c7a882
MD5 e39f0431f6dba204b308da61503eeef8
SHA1 edc10a32f73d66857914be5263f182b994147ab6
SHA512 6567bc12e350dc9e82612c89f5ae4de047fa8c6138265ae6f916e42524e34740f7489876843ff2ebd453bfc9351242f51e82cffdba10b28590fb2f2aca01bc02
SSDEEP 3072:8R6VqRcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/HDeAmcTBVp:8R6kcjJ/jXmNRqBboqEFABZv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
2964	msedge.exe
2964	msedge.exe
2076	identity_helper.exe
2076	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3284	2964	msedge.exe	84
PID 2964 wrote to memory of 3284	2964	msedge.exe	84
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 2276	2964	msedge.exe	85
PID 2964 wrote to memory of 3688	2964	msedge.exe	86
PID 2964 wrote to memory of 3688	2964	msedge.exe	86
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87
PID 2964 wrote to memory of 2124	2964	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e39f0431f6dba204b308da61503eeef8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbcc146f8,0x7ffcbcc14708,0x7ffcbcc14718
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,620040301235636383,15745842748931101187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae
MD5 36bb45cb1262fcfcab1e3e7960784eaa
SHA1 ab0e15841b027632c9e1b0a47d3dec42162fc637
SHA512 02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c
MD5 1e3dc6a82a2cb341f7c9feeaf53f466f
SHA1 915decb72e1f86e14114f14ac9bfd9ba198fdfce
SHA512 0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 20KB
SHA256 1cbc3547219f57ad6c23de13f412c8ee76ab28641ea6c1725061333962b6f088
MD5 397892797fc3a893d689821353364e0a
SHA1 a007426bdbd5acf849a6f3ba07f50f11efe122e1
SHA512 082cc29b400a5c0c9cb287d82ea8ceac1592656e585c4d6618770a511a5623a161f885dcf80c78e4ee0d37b56ee0f7da8fe983d3c54cfce6b397af8d953eae51
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHoz7E:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+o0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 cd20704950fd9ecd48c1b13ae89f36ec4ab4511ded41b58ab26cdb3c000acf7d
MD5 3075e9a68ffe51119dbd204f35fec3f7
SHA1 6d0cdfb7e3e50ac923a50b4338165d6cfb0142a7
SHA512 43f842b93ad06dfc293dae62b45d29217a02d34914b06ae385629f73b40e8074b730dfb48ebfdf52145251ceae31d0b89ab0779c0dc1c41fecf820eda7609f89
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 c4d93c3ecc2407c3b64374683bb77cfbaaf4b30cb02eadf3d6b47f16b472dcc8
MD5 071f208f46885407b03310f3c432fa16
SHA1 bb7392f94d53d6e063bfd99d7e943dedabb04076
SHA512 10e9fa37aac98f6e2d83a1a43c5d413c5351ed9d83121be11dcd73364e317a5de65e5eb785ab4e2b4be894381fbaf6358b661e7af249f66226294c6e58028286
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 10339ce8ba3d96b3f827e71ac30184327084b98b490638ef3bd64c1845e19a02
MD5 b98e5fd0483e46d0301235ab5cd73f4a
SHA1 d2bfda924c68c17f0bf61840b82a7652ab556b69
SHA512 1f89d2e4e5c4cf87dd9795b9d1aa71602166e38358662fec45c9e126895fc7635a5ac3cc40757a5f409fb9f4fb63be7451ceb9a9cea2c341983912b318461089
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e3e79c3727cb30cce71db00e1631fed187ff585698641ab213c26c039737a7d0
MD5 d213fd5efe672ac74506da5a5b71143d
SHA1 75be35ab376d2b3cccb66e0e2867c5f8ef9d2be1
SHA512 27e3f742152648f5243e11a34c341d167845c49bd5e3aa141152862be971bbd1d29b0a935b56b5766d15d087d56df0981eb2c72f72a3c71aa9d3d391c61d0f33
SSDEEP 96:n1kJV1upsV8wpvWMoiVmdeXy3Nz/T7MPCzvE1GKW5Girf1b42Cu9+UWQyV+VD7AE:n1kzspsV8GWMnuNjWCM4KKrf542z+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a7f9a9694b8ea52c9a83eebf3738a256952fed7e5c2cc912b0f12a0283c133c4
MD5 07cfa2717a99c12ec4c435376db08ca1
SHA1 30f6727177de8aa0cab8ecb95eea17f5c1c6d4a0
SHA512 a0fc1ecf14d8c9257a47483371d284b78145db387a8159e925a251ed1cb507fea67d71a2aa3847f6b2feb24fd31f33a08b38727123279c440d60f57aa7dbc4c4
SSDEEP 96:n1kyV1u5sV8wpvWMoiVmdeHCu9+UWQyV+VD7ziEwb:n1kKs5sV8GWMXz+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 edf02019f635600ff3a58b03cbda47342bf49a9acdaeb3249dc5ba433a49fb51
MD5 1f4df0c3d898df560aa4137b1a25ff70
SHA1 2be3e3aeeafe762474795c91aa6ec8fb3172660c
SHA512 b215755100c6ce44b3029b3818e501245a0903b6dfbfbc916519ec54feab815f10808d7a8b115708f76a09557c9546a07d10e3dcccc307e75c94b2eb331dfe6d
SSDEEP 96:n1kJV1upsV8wpvWMoiVmdeXy3Nz/T7MPCzvE1GKW5GiVbrf9qCu9+UWQyV+VD7AE:n1kzspsV8GWMnuNjWCM4KKVbrf9qz+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3d7cf16441a2d88c3372b36db4072d7c48fd13bacd86164d4f3a9d5aaef8cece
MD5 ea79ed18cb2d394e4924beb075091299
SHA1 87a7876503032da66fe8c4e04dc9a87c8c79f88f
SHA512 c8e9549ed47e1ab87c64ef3eb1bfcbea925ca2f5f33277b62fd97df734204c5d9574d7c8fee9a4237cdb6afe5c19313990baea37a019ddcaa89aae67b70a38b9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqPde2RUrNvbqYxvFt2pTEp:A9iIxuERzA83h09RZxYqP5C+YTt2h3CH
MD5 SHA1 SHA512 SSDEEP

Submit Download