96aef95a0aee46a4d34ed77c521c53b2f39054045225e0e52d529eaa71930568

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 07:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1b725536cb35d3f6a6ba238d1c8b4525_JaffaCakes118.html
Size 222KB
Sample240506-jfp3csde7v
SHA256 96aef95a0aee46a4d34ed77c521c53b2f39054045225e0e52d529eaa71930568
MD5 1b725536cb35d3f6a6ba238d1c8b4525
SHA1 b3cc6221c3c7fdfa5978fc9a48a0cbee02a5b784
SHA512 11b948a2e5a2cd779eb8bfd421bba0573ab60d0c4764b814ce6f3f72aea7c571a67f1dab70b8f1d3c097761778d138399646388ab3c4d39b5fb9ba0fab3a4007
SSDEEP 1536:+uztRWQ2yOaj5VaABmalwoqE2Bb6y1T0ime5ZQ7gZeE/uK3h:+uzrxDOOlwoqE2Bb6ArUWuK3h
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
1160	msedge.exe
1160	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
2428	identity_helper.exe
2428	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 3744	1160	msedge.exe	85
PID 1160 wrote to memory of 3744	1160	msedge.exe	85
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 2636	1160	msedge.exe	86
PID 1160 wrote to memory of 3052	1160	msedge.exe	87
PID 1160 wrote to memory of 3052	1160	msedge.exe	87
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88
PID 1160 wrote to memory of 3796	1160	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1b725536cb35d3f6a6ba238d1c8b4525_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc923546f8,0x7ffc92354708,0x7ffc92354718
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,836286687056440168,16990750565207952847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

f_000021

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 f5cc712de77bb036f0d5502e3068aa02c77fc8669bc4a17937ae4091b340984d
MD5 56b393bd3db8c0b1dc87edb8f71b7ade
SHA1 71712c2a33639066b7461625e33a7cb91ad13cf3
SHA512 4532fd079505f9a6c51a824f4761192736cd117bc4df760dbd0198104762b265fed70400bd832d6d7df9789210b92e15d8bbbf05e260c6c8ba226e879bcdc535
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 83d8fa8a4e7d6f87858da7032c9b4a13b15b9ef2d0086609b465223b623d70ba
MD5 b9afbd65dfc4eb724fc480235f7e4f00
SHA1 6210b7ec3594d63c23452fc4941b98f5d9a1cdde
SHA512 96195c76db4eedb1b2270b7a67758e0c844af61c9d333c556a5523508c1ef0ba882a27fe566b5c68c06c48d79f7157b158fa28d864a2de4f9fd96e9892a57101
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 7fc83883eb98ccf53b5eb09f4dc9aba10466f0014adcb723cf0ff81c505c03a8
MD5 573a32e594c9fc5ca9a2a36024628b8d
SHA1 b0924386bba751a2dcbd23cea637774ff9009fc6
SHA512 372aa6c1d70872913f244b37483d118847703d28211c2044974ebe31746840823822b6dcb2f1d315930d00f3b9aba7c3dc1201947fd0eca561df7f2db95fb29a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 571997b0d601a6f121eabd6e7e293e1521556ce84ff934ffd0911229d9de6ea2
MD5 3df158e79f0985b6054b4720e69f71a6
SHA1 8bba017b36a5a425c51f941954fe65d597102eba
SHA512 4bb234a929756e11faf3c9a23af9f29e149b11e9c50687866134201ac63ae1bfb378113860ce82c11d8500076d6ae764954c1b8f4fb328cbcc5c9536cf4fed2b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cf96ede819025123aaa7b233555306b3ac822f2a0bbc5b959f9b79508ddc5f90
MD5 e78bad706d551fbeb3f2b08a51db8897
SHA1 423881f303e75d5452734f9cf886af9a4410e7b8
SHA512 3845a289adbefbf8c6f5be30b993f58d9c053587a61ad8d608e7a5e2bf707aab0184a7f79c65b464ac0255b5fca807ed7724e1432808dcdaf0402454026c216d
SSDEEP 96:nOkIVI13S2niK1wpvWMoiVmdev5hNPVj2IctsV022dtY8RlUWQyV+VD7AiEwb:nOk/hSJkGWM/5hNPd2IctsV022brrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c4449d14d6b2536aceec7b2f2f24e699ce7481badeece6520236cf823982415c
MD5 753b5aec17b2b5b4f688c60da6f4b99e
SHA1 100daa0dffde307d3700db0164fe36c8291542ed
SHA512 e6ed223768e23c1c0972ad328a066211dd95f537bcdaaddd6194e5fc5dc8031649f1d9cca642cde20b17a2a5dfb172d9e33cc90d564a7cd913b31ca969cecdce
SSDEEP 96:nOkNVI13SuniK1wpvWMoiVmdeHdt7RlUWQyV+VDCziEwb:nOk0hSBkGWMXbnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3b6cf964c8c5401888d672e21c39cdc17d70b783e3763e4b09a529449678261e
MD5 debea85f8ddf17d7913179ed1520d750
SHA1 a82d85d7f3025e1de62f3274115a333149953885
SHA512 36caba59e21b360432b507ae134c8d104205eaf5996df31311de392e8a96cc9af6617a1616a8c2cb88cce0f5054eda4a0a32fb2c4e1883b90781649f8f775466
SSDEEP 96:nOkIVI13S2niK1wpvWMoiVmdev5hNPVj2Icts22dt7RlUWQyV+VDCAiEwb:nOk/hSJkGWM/5hNPd2Icts22bnrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2d109e4535ec78c927fd6c6af986fd8b0973d7f5dfabad50a3dd09d50bd2693b
MD5 a489e7fc8ffd4466c1cba2b29e6217ab
SHA1 dba770588795ef530fc7af2095c63fa81325e824
SHA512 9d7e7d0049c5f41f58149f3b087db0f9bbc4ed02b4b4f0e3bec6510c0d41d552c9b4be41d01fceba9071e9b121afd0e2f2980aae3ad3e788988574f2d47cb406
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPBcbe2RU8Oi9+OblfBhDa/:A9iIxuERzA83h09RZxYub9/XDafEBfw
MD5 SHA1 SHA512 SSDEEP

Submit Download