1de2ea7dd3ded633a139f0d6831de2d7ab7349c3f2714955e73949de9f585cb8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f3bd68fca59a105c7532240223579ab_JaffaCakes118.html
Size 162KB
Sample240510-p83f2sbb63
SHA256 1de2ea7dd3ded633a139f0d6831de2d7ab7349c3f2714955e73949de9f585cb8
MD5 2f3bd68fca59a105c7532240223579ab
SHA1 670f4b3f40289468bf728a737872fc315d7f09a4
SHA512 ecfabbe15fc6534db293665cd01722b252e9c681fce615f1e6f45f1ad42997b4b8f6ca2be6c93f073aafbb454f92da2b93b046a17862260b54baed3bf1a5c036
SSDEEP 3072:lT8pBqL0dDtZpkjr9tfbUfNqiRybRpuyf7kjBu4u6xt:lT8pBjtZpkjx9g18/6
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1076	msedge.exe
1076	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3532	1076	msedge.exe	83
PID 1076 wrote to memory of 3532	1076	msedge.exe	83
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1512	1076	msedge.exe	84
PID 1076 wrote to memory of 1268	1076	msedge.exe	85
PID 1076 wrote to memory of 1268	1076	msedge.exe	85
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86
PID 1076 wrote to memory of 2768	1076	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f3bd68fca59a105c7532240223579ab_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7a7146f8,0x7ffc7a714708,0x7ffc7a714718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 d5ee55da3345b11dae36eef796270d51bacde7b5d20770869bbb0dff6a43aa38
MD5 31aabf6adb520d11f7d4ec70f0ba347d
SHA1 e79299007237f9a7a80328432ed776233cbeb400
SHA512 2bfcb643282fd0266e108ad89ffb05411f8dd5f051acd90084b17c4d0d38edcc5c66943e9da27d166bd01b5cf771e1f03d93fd1494f2dc831327d034507ab53b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 4bce228fb90bedafd900e059bd23ad88b5295323469ad9ccdc1a6fe2607a3310
MD5 14ca9d0db97306aff93214b156a450f3
SHA1 33a794eeca244490f9b052fbef8e301fc58e0a0b
SHA512 a1e7a22ad9ecd88cf9d5c2f9467eb2412ef540648021e913c5c3dd36d53bf18f404d9515217d6e9dc34ac4cf6d19e8344bac20cb577bb2bcfba862c5c5cdc1bc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 18a9f3dbaf97e948e76e587e21965e563906e3fadae1bf5bf885527a61b4e9fa
MD5 dd70497edef066478fb51bfbd3837122
SHA1 3ec050b507e8c93ec19729c777ebe0d816d8db94
SHA512 54ac14e1c37afee065df2f16e963b3f343451b84a74c5c6cf9234c2f111bb1da85284e47fd1cce6f378b41681a30732680a547d6e04d739b138eeec998d050d3
SSDEEP 96:zEU8mz6rF9kQDOx24GPEQGeGVGszuG6SGmG0GIzGbGd+F:zEU8mz6rF9kQDOx24FQraHuqD5d+d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 860fc8653910ee2566b7f2cf57f06170ffdc41bcfed11b5d6aaa6b8d99e3ff5e
MD5 6fbf0e72ce4b776d92fe064009e8af75
SHA1 965b92250170442ce35de3237a703cc4f8cecc3e
SHA512 787c06abea3fd937cbb17b3482be5341d2cedca7d8180d05c1cf86967db5268d2110dc18e6f751f62c8084778a6f0817f72aee7a71d8d0baa0ac029afb8e8114
SSDEEP 96:zEU8mz6rF9kjOx26GiGwG6EG0GIzGIzGLGRGSG9GhGPE+F:zEU8mz6rF9kjOx26v/85dZGILGUFE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 6cb52c97e58fe2453ed9248de3aeeb25f1c4a9acd10c570c65831755e4927f71
MD5 43ed0bae42d3e857dfec80eebd602589
SHA1 40f997ab3881edc27b388ef68776c326f96ad2ca
SHA512 9f33f87f432f8bb35fdbc505a63dc63611c474248b815f20daa2440fa3233ec2b69b3269c0a5e9d31f767624f77e1eaaf0187d290f57d4ea193ba88444b19877
SSDEEP 192:nskMgoGWMTep8xvflJqPYFoBHKMErVC72wvrV:ns5glWgjmHsrax
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2ff1eefd9bfb92e7d8d7aa841a25f18826cc3c0e931705f38b1982a62feda951
MD5 b0aed4ca7d42346dd161b7a97269bff2
SHA1 06e25fca89c6135c127d7a338ff9e65fab6458ad
SHA512 82dab4b1ade66cc9fc515fe3a7c881ffa501cd54134f4ff2d822fea65a0c8a157f6aee3c4c61caf6e6573cb76af4184501b90e115495fb87a1b3ff4f6e2b2413
SSDEEP 96:nskdoY1OpwpvWMoiVmdeHm0EvUWQyV+VDCziEwb:nskvgpGWMXwvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 fdbbe5c32e5e9c006614719b7dc52b427bb9465d3b1db20f1e5577f1d61182de
MD5 6cc72744bbe7e18fa65397dc633bce9e
SHA1 85dbd823747f9b06bf1afb649664bfb74d31a201
SHA512 1650b9bb5589967fac777ab42b973eb30626cfcdfe198d3611c79089b5e1549ac5106e8428bd29c72f7b7e61d5d25fd586913f63fb417277268438aed3c189b9
SSDEEP 192:nsksgoGWMTep8xvflJqPYFo7BHKMErVC72wvrg:nsdglWgj0Hsrac
MD5 SHA1 SHA512 SSDEEP

Submit Download

c1c0745f-a60e-41de-b0a7-c90343ba478e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1c0745f-a60e-41de-b0a7-c90343ba478e.tmp
Size 8KB
SHA256 d85a18b4549d38cd208efe84649fe084b3ce154c1bbd0718c03cbe6c8e824136
MD5 17c313a49de33ca7d6e859cdf1560695
SHA1 6aa0ccadeae0ae324f1c66f3c542df48f22ef06f
SHA512 701b7e316023433e5a837a6f9ee9df2ce6dc3c2aadf0fd36641e0b5530664986bae8545c468f6affedb7b0f9783b447964d5e676292f589f35fe51925674f627
SSDEEP 192:nsksUoGWMTep8xvflJqPYFo7BHKMErVC72Uvrg:nsdUlWgj0Hsr6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5f46f743f8308063f5704fdd8e91ec0d09a0b12a02be2b6e223be3c097f39160
MD5 5b01a8ab5724db94a1e31284d2205b08
SHA1 072fa7f3bfb4298eafa745b4ffb9e951236e45a0
SHA512 4631cb58fe9cb97399dde1b5894257e0fe8ae5ff77be2512ad4aabbb7bbb284ab09f7204e74a54c8ed1ac9e66ffbf41e151e0289a1113406596f6c15c2eef5fe
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKe3e2RUrXz/U+OblfBhDah:A9iIxuERzA83h09RZxYr/+/U/XDafEBe
MD5 SHA1 SHA512 SSDEEP

Submit Download