e8cbc7f11a729713e1654ff7234045a28f0659d8284f7a7faac3fabc122aa9d2

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1022e192b456f397587f787cecc9b2ca_JaffaCakes118.html
Size 65KB
Sample240503-kv6t4abb71
SHA256 e8cbc7f11a729713e1654ff7234045a28f0659d8284f7a7faac3fabc122aa9d2
MD5 1022e192b456f397587f787cecc9b2ca
SHA1 cdcd3150ca396624d2bff7b25b517cade2b4515f
SHA512 d0470253eac634b0269aae56b1697db95ffc04bcea2112fd4e262ed35868f9a12c7d6ac7bf141c49281e93b21509475b44256a17f98b2e2bb6c82955b795a5bb
SSDEEP 1536:AHcu42JmFrP6UO2tIP8oGNZdzXRnZEngayB:qJsj6D2mANZdzXRnZoY
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
4940	msedge.exe
4940	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
1620	identity_helper.exe
1620	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 3412	4940	msedge.exe	84
PID 4940 wrote to memory of 3412	4940	msedge.exe	84
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 1660	4940	msedge.exe	85
PID 4940 wrote to memory of 3640	4940	msedge.exe	86
PID 4940 wrote to memory of 3640	4940	msedge.exe	86
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87
PID 4940 wrote to memory of 2084	4940	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1022e192b456f397587f787cecc9b2ca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbe0146f8,0x7fffbe014708,0x7fffbe014718
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10795726797093652833,18254099078312886775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
MD5 4e96ed67859d0bafd47d805a71041f49
SHA1 7806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA512 432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
MD5 1cbd0e9a14155b7f5d4f542d09a83153
SHA1 27a442a921921d69743a8e4b76ff0b66016c4b76
SHA512 17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 2cf3d9bb9823a2fc39c575d87d4d7f3685d6aba773872ab2f177f4465188f130
MD5 84660df11953b5b4789ba64b5d9001d5
SHA1 cd9826fe171b7420cc90fe38c874192070aa320b
SHA512 e9e0ff780411dbf46fd97caed4d8b94742bfc672c8d0126ff22c5917e594e304ae6b297f2bd7c28b73792a98f8996de12ebd1a57fba853928a7c43e912dc7e12
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 536afad699cfb7af500592ac29cf716dd5e4896e60733c12b14b73d1f6b234f0
MD5 36b4021742c08fe6574e4bbe10959b1d
SHA1 60f648d24915d484cd70f2dbe5a808993715582e
SHA512 a7220a9df7156407c9bb9c4eef2150bb1a2255fa9e4d4a40b3c27584b5ed0d1709e224d798f6036a5b3eea0a531e553fbc348aba41a49738f2f7b8c4dfe4fb32
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 daee625e8a064b2eb5dae6a9c927f50c3a2918caf8642e6e564eb583972b923f
MD5 f74d9868f2f59b001a9af1b6577275d5
SHA1 0163301bfbe37ed520fc7918bbca0926f3d801d4
SHA512 548b87290fa69ef1718047fd8f66fb8b209765dc032ac424d1a79f3830c4847c19c72fc59ac827719c992e4394a9f0c24791407330d538c45980b08aa84b1185
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac21d659b42cc8cafeda1f548805176b775ff5206275061b0d283991222efa87
MD5 c7e0359375772604ee4012abfcd46387
SHA1 938b4c26eb80d64037d55c5720d3bf439a22b889
SHA512 b4d87b09406b49c3848ea735c87d84037e9e3abb7039e605eb167d6439752372e2b9c4a12c0a83cef786770a63dfc2efddc6b88c62f4959a07d5e2dc7aa7dfcb
SSDEEP 96:nskNB1wVHazuawpvWMoiVmdeHhawUWQyV+VDCziEwb:nsk7qRraGWMXdro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1265f6305a9dc2ac278dca01d4ac914804885a7bfa63264ca718e09287315d10
MD5 df9f8badf7a78c8dd0df91829f06a183
SHA1 e68ac25e29d93385c7a29e4ca17650bd538f4420
SHA512 5a4bbc2ecaeba76365b0713f2f4bf7921ffd1d5aedae94c309a7447066a40a4f3cae6b611169f1bbc7aa0663139634d38cb719868e5aced0b823d0e91029fbb3
SSDEEP 96:nskIB1wVHazuawpvWMoiVmdeMrKQmmE7r41m8Gnw52hawUWQyV+VDCAiEwb:nsksqRraGWMcrVHE7r41mZw52drV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dfe846142f10a644eb77025d4239e8276a16a603a95b15067f676319528fda6a
MD5 776217d1e66b427288fcee96f794d86c
SHA1 272e11efc3af52cb941a6f940ab62aaabddccc07
SHA512 dc7ecd6e21cf8a8d1fd8aa88b5b8c6ce88f81443ee800418b90b0fb8d5fdc70dcf14e3dfef6a437265b2b8f15e7c328eaa1030ad29f3691415ababd15a94cc53
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJhP0Ee2RUe/9qMl+OblfBS:A9iIxuERzA83h09RZxYPcqvDl/XDafE4
MD5 SHA1 SHA512 SSDEEP

Submit Download