70bd94e7044c0c78602c7d401c7cd5b71d3e8e0530925500c0fc87debd513c7b

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b77d08a729fcdad12e050b07a204805_JaffaCakes118.html
Size 19KB
Sample240601-xtgvssca8x
SHA256 70bd94e7044c0c78602c7d401c7cd5b71d3e8e0530925500c0fc87debd513c7b
MD5 8b77d08a729fcdad12e050b07a204805
SHA1 b5dcb38af808e3091c2b0a4bbf51a0d7a38fae0b
SHA512 1537a3fdc02ce3e47d69dd5b5a202e3eab73ddfc66a6ec8926f9f22a52d55b1456f951b80e0a88728a9a77de4b196efd7e13437acf415653f899422089f1a02d
SSDEEP 384:W4R/uGUwqgvM+WDvil0/e1uELyk3TGQAS56v9CIly0oqCKDisf2GYiQ2gCYO4aST:W4R/MBgMVzil021zLykjGQAS4vV+EDc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2392	msedge.exe
2392	msedge.exe
1132	identity_helper.exe
1132	identity_helper.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2792	2392	msedge.exe	83
PID 2392 wrote to memory of 2792	2392	msedge.exe	83
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 4968	2392	msedge.exe	84
PID 2392 wrote to memory of 2764	2392	msedge.exe	85
PID 2392 wrote to memory of 2764	2392	msedge.exe	85
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86
PID 2392 wrote to memory of 4536	2392	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8b77d08a729fcdad12e050b07a204805_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f8046f8,0x7ff80f804708,0x7ff80f804718
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12336816839794479098,9619248850378137900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 d528d9483b01d5395c8335662c8d1acefe163803564baacbc6cc0970f6677e9e
MD5 1efaf1f8d5bcd14c700b731c60857b46
SHA1 d96bcfaf2098c2fec383f691151f9399886f837d
SHA512 1d48a59321a480ec303a36636e3f411a39c4a4717bb1e6ac53884843c9d35ec9d41a13b6596b8f78c8fe46fa6f6455597d96a6ee5fa29f3f4efec86df4ceaf22
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 de606d4b20848d31149f2769631f01d51899a395081d9d4e82aea5531cf4cf36
MD5 f6dc94f6af4cedf1c00b81844444676e
SHA1 5abb8a5fc3591ad5b5f4e6403370b5acddf15edd
SHA512 7ba8c0c91dc542a351db1deb7f5ebddc828f023386d486577de8a0290fd2eecf255d436a928a569a3ffd82ebf59e97e846bb565b5cba865a7ce381f029cd424c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 3fa2d075df0e9624b4011369faad0eb87e40095186a006ff6deb2770798050dc
MD5 f878e50c044c125e5481f08eb2b38544
SHA1 def953b4defd704fdbef30ff0a29a707285c517f
SHA512 1a72ffd8ec26d4e842a60617b2e7b02f828c982b20134cea4dbdf2dd2ed8b78694e44be09436c05194b8f82f1edf85566bade2e660d456e5ee7bfa55065652b2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b003f87f6fb2de92a7cdb9ce9a86d0f67e9d84feb72e8e491b68c4af792bc22f
MD5 febc03489d1905c8b8ff3de611bf0f29
SHA1 af7bd550f79637abdb50bff9c3d67bdaa241453f
SHA512 96121031f3f5ef95b024767a50d97f15b91c81a13bcdf457b2895b7e346f0fdf452f42d1835b732208eefb778de9d2bf97ce7eb70fdb8f9368cb845c77600314
SSDEEP 96:n5kfP1Hn2wpvWMoiVmdeHk4cUWQyV+VDCziEwb:n5kXtn2GWMX+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4ec71ffb96d9e81116a1f1a1b95526fc4f817aad665c6c86eea0c362ee6c0154
MD5 f119c2a59d03b6f8d64fe3dca63748a9
SHA1 6e6bd454298aff06bcfc8a3d2d35c904b654e665
SHA512 29af7af3005d0affaf2d2b03b34d4e493502716efd7e226730619feaf2c22e9b26ebb8d86899823e21202b92c4f248de1b5ce1a750fbeca4f9668dad8a922410
SSDEEP 96:n5kWP1LB2wpvWMoiVmdeljNqVnhXx92k+cUWQyV+VD7AiEwb:n5kQlB2GWM1jNqZhXx92Arg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f8bd8b7e5ef64e258ad55975ece72ce07bdd27f45a538f7a22925ff37df5623e
MD5 489e8e95219585f1be31dad99072a010
SHA1 1feb6a0c9b0a1ba5e06b2a334b10c950a54725f3
SHA512 fe9a46f5fb9aec44b92a9eaa9762fdd5ca24c65d23773e8e107cdeabd655364cf8d2eaa69eff47e7e3b022ffafe1fefd5deac5673d2c193d10926e26e475600e
SSDEEP 96:n5kWP1HB2wpvWMoiVmdeljNqVnhXx92k4cUWQyV+VDCAiEwb:n5kQtB2GWM1jNqZhXx92+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ef70033336996e3bc1d0daaa7ce83ecae9f0e837484c8d11c2465dbaa00209fa
MD5 a7904f491a5671a259199f2d9fc84f06
SHA1 d6e92a04c50701140bafd307c3ae8a46ab0d1ab6
SHA512 8632dd5b84e9b5080d291aaaf1490a13f301a1b45c7499b4b517f4c45461fa26f328549e4c24da31b8d66f8ce5e122315d060018f1cf2f2ae9de854f572da3de
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNDHe2RUiy4Vn3z2OMDCRHB:A9iIxuERzA83h09RZxYx1naOMWRHqlWT
MD5 SHA1 SHA512 SSDEEP

Submit Download