f84e009de86a2fc912d7e83fb18dce64c8686b6fccf4127f155019e1a254070c

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
175a5bf301f5fdab9702a5131dc0bacb_JaffaCakes118.html
Size 146KB
Sample240505-m2arcabc22
SHA256 f84e009de86a2fc912d7e83fb18dce64c8686b6fccf4127f155019e1a254070c
MD5 175a5bf301f5fdab9702a5131dc0bacb
SHA1 a398fe4db52351998c0fb08eb6698f726a095398
SHA512 afc06bf901dc6c39c596cbeef771fdb6bdab96070f025ddef3f943fbd93fdfeb28c842c7d28a11f9f0f95a8a0f8ae01fa1097e193249720d0f3fbd3f3904b3b7
SSDEEP 1536:cbcCiWqOPBuaEjKCXyD7AUXCbBUotXNS0:4timPBuaEjKCXyD7tXItXNS0
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
64	sites.google.com
65	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
3308	msedge.exe
3308	msedge.exe
1352	identity_helper.exe
1352	identity_helper.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3732	3308	msedge.exe	84
PID 3308 wrote to memory of 3732	3308	msedge.exe	84
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 1516	3308	msedge.exe	85
PID 3308 wrote to memory of 976	3308	msedge.exe	86
PID 3308 wrote to memory of 976	3308	msedge.exe	86
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87
PID 3308 wrote to memory of 440	3308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\175a5bf301f5fdab9702a5131dc0bacb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa184e46f8,0x7ffa184e4708,0x7ffa184e4718
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2621846450600801248,15438890778350967555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
MD5 dbac49e66219979194c79f1cf1cb3dd1
SHA1 4ef87804a04d51ae1fac358f92382548b27f62f2
SHA512 bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
MD5 a9e55f5864d6e2afd2fd84e25a3bc228
SHA1 a5efcff9e3df6252c7fe8535d505235f82aab276
SHA512 12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
MD5 SHA1 SHA512

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 785b02fd3b636bd112be64a640a794d344004a6d495fea017730780d1af7c059
MD5 3866ba5d5fcde515240e973934d11040
SHA1 66911b7fdd79e886d74eaa4efd85b034e993ddb9
SHA512 a13656eec88d042f49f1625e136f4e8860fce15abc2af074bb20196fbd8b29439a8d00146732ec0d5216c14148fb654c8b4aa52ff83eb60da62efab034c157cb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 977c7fffd91829bdee17490cf47921d03029a67dfa54b6a1691b60219a61e686
MD5 163cc2a2e46f0880d1077d9e20fab955
SHA1 0ebdabb9ca7b73e71b241196bac838d083b268be
SHA512 24526b5285c944d20525d4f6b4ca6e7d3c167a65a4632147f56553e3385bd1559a7d5e996ebf99bec83f8d4ccced97766c55c3bac55e8f21fb8711706a864869
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 260ae8bbb90dfab97af80f5d7541dd235791ba8d0d6d5987a344516fca2ae3cd
MD5 c20213af33f864eb4c78cdbc475298c5
SHA1 a35cf9ce6ffa5b44f52ab40f2857235ff5205330
SHA512 b0ffba3df69e5fa13c7b61fc36f600cb3c6f95a28f9e3564a3e7e04aa1dddde4725f61c26629ca1bfdba8da349aa93dfd04871b243808610b82d1f9488525e3d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 ced70630fd4adb56ceeb9ab55ae537a872ac8c9ec3df8af49fbf380deac7b30e
MD5 1aaeef6fe91e7b4371b2fa43383ca1c3
SHA1 0357977d1d15d6f7c1c8214d83e95b41a0113b15
SHA512 5dbee7382922a2b8613089d880d7792c189cd5875f0cd6dd5def8e8e41d1181766569e0903956e226cfe2044473c62b9794024e73f5239daffb8c87600b7f8e6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 db57efc87b04228dc307ec06e01d13ef8eea294390db721bac56ec86c61e5be4
MD5 ef903a3a0c7f92ede6645a3938a70d06
SHA1 1d99e0abb16d73ae855d5f2c6d595827f1dc779b
SHA512 5889ec27a69e2d5d20804e1ccc97d0ac83284b3cc5bf4682d481984c4e16f91b8a0458fd29c771d707c65ece0dee0c84708c79f2511a976b866c65840c53fa72
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 44b9415f0907350cf5690062a7d527bf8b7e143bddc76de59c99308fce13d59d
MD5 7728b73b4345a8ac7127d896c4559116
SHA1 cb6956b6ab2629e6c84cd04e1e44803dfb7b7c0e
SHA512 c5def3d8cd62c7579e5c0c5c6695f8d05420270b73a82ad6dc9240b6aeee8d9100fe67bbadbd5992788c7013ac5b8625fa8757890834d9ad1cb3ee280cb910b9
SSDEEP 96:nNkGg1LSOm/hXwpvWMoiVmdeBNlzbl5cVwTKsHs2ZnzqUWQyV+VD7AiEwb:nNkz9FchXGWMRNlzbl5cVi1M2Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 96ebbefaefee1f11f66ac91f2a8fea0a9eaabd73c98b477f41ca38ab8c0dc173
MD5 899e948a8b480fbc0335122f76e3e759
SHA1 b7b7cfb665cb18f81be6037753c476d61d0df29b
SHA512 f0f84caf0d07a9c79116b51920180612715ced5213507ecf01e976023d872638092f4e48636fe071ce6676992ff1263988619bcf77dc76c6c78d797c5cb7f3b3
SSDEEP 96:nNkzg1Lm/hXwpvWMoiVmdeHZqzqUWQyV+VDCziEwb:nNks9chXGWMXnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 eea052f5132d064ab5b8f6648c52c830cc5186e193e745ded17730f0a231a1ac
MD5 31847f2a1dd06b415087066912d7c9f5
SHA1 53309812b1c58c7243ee85b9319eff4a07a0966b
SHA512 b3f43ec5f7fab3309ab5e0e24a63f46022120a4816f2b504626707f38ad6992b7b4b47bfe770c9e95b82b5ee746ea886df8ae67ea0dda6ceb8b5c73675fd25e1
SSDEEP 96:nNkKg1Lm/hXwpvWMoiVmdeBNlzbl5cKsHs2ZqzqUWQyV+VDCAiEwb:nNkH9chXGWMRNlzbl5c1M2nrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a5786c5a880f51b56ba0bcfd5c6c74d083af73416d01363045768a697976a467
MD5 7a61cc8ad9ed1b6c742e63c7bfa30f75
SHA1 bcfaf61e56e60bc7664fc10b6d5aa017a46562ab
SHA512 db9c88817c16b607958e51c9ba4a2d555946029795049428fbfee8a03a878c5198ed6889fa47e311888451ffef6e273f014afc2a48c9189c3958e45052b608fc
SSDEEP 96:nNkKg1LSOm/hXwpvWMoiVmdeBNlzbl5cKsHs2ZqzqUWQyV+VDCAiEwb:nNkH9FchXGWMRNlzbl5c1M2nrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cb1f93bbfe47c07d9cad8e96a258fc1f69177db98d9433e799394983e3e5db3f
MD5 c02af1f9c6b9dec13ba8180187255986
SHA1 701e56e96ff5af1433cd39548bbcfc9bcec6f662
SHA512 6810fab5173aa549dfeac95665431159d4f0d992eeefa4686a7b44091a9d5b0b968c5435e662892d38ae389cef819270a8dbffa0cc4a029fd95abd844f348368
SSDEEP 96:nNkGg13SOm/hXwpvWMoiVmdeBNlzbl5cVwTKsHs2ZnzqUWQyV+VD7AiEwb:nNkzVFchXGWMRNlzbl5cVi1M2Qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3aa5c5c16c846b9d7af9cf826744546f936d9db8f7039fa749f814df120ec100
MD5 4e28b622958da3742319b49422e8a41c
SHA1 e0e87d5294a0d4e896358d504e9fd270186e167b
SHA512 aab1f1a79c30dbd59517e8ef06bcea3738c668522aa19eae6c3dc31373de732e489c56b5420f63c8b9675bacc73406e66a402f8b4280c006fbc21123b81e380d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphY2Qe2RUGwqGE+OblfBhDe:A9iIxuERzA83h09RZxYh9OmE/XDafEBk
MD5 SHA1 SHA512 SSDEEP

Submit Download