45fb9e9b2703949b8ebd4892144aee81e2256fe7c677608e8cda3d5c2da93d08

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0df509bbaa49dbddeca7aed493148632_JaffaCakes118.html
Size 209KB
Sample240502-j2jsgada2v
SHA256 45fb9e9b2703949b8ebd4892144aee81e2256fe7c677608e8cda3d5c2da93d08
MD5 0df509bbaa49dbddeca7aed493148632
SHA1 a736f60ea6f14f6526e56302833b48cc7a8fad07
SHA512 82c606f5d499d31e5ab52d6acdf2b5151a1f16107a6717aa711f941367c47f1e41be25f99cbb2e654d480920861138084d86f178478a89afc0a82ae2a4090a4e
SSDEEP 3072:qkclGsQSu06wBO1vqNanzkPjn40BO1x3nCPAtuBbxw:qkcln6VSeAzBO1xaW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
1360	msedge.exe
1360	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 4528	1360	msedge.exe	83
PID 1360 wrote to memory of 4528	1360	msedge.exe	83
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 780	1360	msedge.exe	84
PID 1360 wrote to memory of 4508	1360	msedge.exe	85
PID 1360 wrote to memory of 4508	1360	msedge.exe	85
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86
PID 1360 wrote to memory of 3316	1360	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0df509bbaa49dbddeca7aed493148632_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af84718
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16502078311113574057,4830206828607668362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
Size 1KB
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
MD5 SHA1 SHA512

Submit Download

070E0202839D9D67350CD2613E78E416

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Size 230B
SHA256 f53b0d45e8e10b9c052ab6a51cbf3cdded484a3b2cae6b07c47281096f176a4f
MD5 5600bd5450d3d58c3c55265f07294536
SHA1 1db8d8cbbba0b32f411d6690153ee93d3ba99ae6
SHA512 f0165bb97ed943e0103b46d769cadc3047c3a7987dc3fa12909e380fd00c7c755c5c522c006c11a3adf72aaf2f98771071a2f9972748a590801837e6235f090e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
MD5 dbac49e66219979194c79f1cf1cb3dd1
SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
MD5 a9e55f5864d6e2afd2fd84e25a3bc228
SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
MD5 SHA1 SHA512

Submit Download

6790b77f-f3e3-45f2-b3d9-c92b2e557011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6790b77f-f3e3-45f2-b3d9-c92b2e557011.tmp
Size 5KB
SHA256 1f10901564855420ccbfc23a1defced266ef2a161b1ccb2597bae423595363c5
MD5 8a179fb82b04108ccdc69497c73857b1
SHA1 c635d641668872db90616cc872b334362b523519
SHA512 72499c530b2a4d063ee41421629a71e3bec5617eedd7c05fd5b0bda5e7d2af4e984f96a26f13d94d2349d8d26ce8c16c317e18c76879e984d35cc4a9dd3fce88
SSDEEP 96:nqkb/1REK/hXwpvWMoiVmdeHZq7UWQyV+VDCziEwb:nqkDPEQhXGWMXaro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 456B
SHA256 85518813c8875910033046314d4bdbc28f8191a392b8c6ed50a20e10951fa855
MD5 54a8c952832c656e4853aac89e260177
SHA1 024677c90a5c2c216455b2fda8d16bf4550a8c7b
SHA512 ad674e7cdd36b5e96654b5df095ea52c6a4934c8d7d774a7e25112118314befee345a96ee45479e418b900c08a305c14da08ef855b26242ac7eb91b24c66e168
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 08da92fae0ad6c5b50009d16f2652c0cb6ba7dee3f25c6fa96008520cae7d52a
MD5 ab20e61940122bff20c9e024523a6a2a
SHA1 95a18f1295878910c773088ecfd23e63955e14ff
SHA512 d24f42a8f19c4d15f71ead9050e60e343f6311a94abb5b41957c3423a2aa6a305062af2226bc0b627e8551d6a970087061a2878f53dd5d92217666c892d31736
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ff828bdc875da02eb73c15a615f12bf0d995168827bf84dd33d1c6043985f45b
MD5 abc573759f3f4aaa96a99590c3eadb02
SHA1 23e6d428b71c0b6214ad0f629ffdc64b05988dab
SHA512 6f6d1056394e94c0edc5c81bab75f58526a4e8ebeb14e3a95290ee9eef192f4ec91673f857b9857bcfedb4047ecb201ebd68d8ff2de03811833e11bd24f62de4
SSDEEP 96:nqkp/1REA/hXwpvWMoiVmde8fJltooFyX9EcU2ZHa7UWQyV+VD7AiEwb:nqkZPE+hXGWMsfJltooFyX9EcU2Crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cac36854c1b3670fb0e979f3d0d559558c501157f36b4a92eb34a74fbd8789ad
MD5 1e86d31afa6c8d4cdf6dbc51ab2a61c5
SHA1 6c1b3969a6ea7de47201dfa440ddaacad9376ae1
SHA512 63add871bbaf9449da5fc8677d5c804f8ae8f4f39b1f1ae29c44e4b430206b5f450e98387d1a838757afd43cd06dcdfd97796e6dbd6f04296ba46b055c55827a
SSDEEP 96:nqkS/1REA/hXwpvWMoiVmde8fJltooFyX9EcU2Zq7UWQyV+VDCAiEwb:nqkMPE+hXGWMsfJltooFyX9EcU2arV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bff80cfaacd2af310b2767e6576d8fb31d73216ed63f971a29b6d82b83c90588
MD5 9869fa158f6d9e9d6e35f8b863eea1db
SHA1 ebbf2616147773d7566bda2c42cf16e560c06e7f
SHA512 0080173b86ff5b370a8bc277b3f80e23e4f560a9a35b0bddf3c7a0dfc56ae28e9834227f8b700f2efc1d8011d99c97e95d6e249cf2ebcc7f7dbbd9acb73629ef
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupQiY6e2RU3wqGh+OblfBhDp:A9iIxuERzA83h09RZxY1vPh/XDafEBgs
MD5 SHA1 SHA512 SSDEEP

Submit Download