34f09fda2d941c6405ce46d10548739303cf12ec363f531ca806889949ba532b

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fac0e203be459c57aeb6b54ddf3d47c_JaffaCakes118.html
Size 56KB
Sample240602-2hryvahe5y
SHA256 34f09fda2d941c6405ce46d10548739303cf12ec363f531ca806889949ba532b
MD5 8fac0e203be459c57aeb6b54ddf3d47c
SHA1 aa1e02b4e3a5999804fcac8df6c6eb68ec2cb93a
SHA512 3014d9e9a52b111cb7b2dc6ca97aa9f36a328254f9b092a3ca5fa678c2f62298fbd169f5399fe77747c30e7950ab21128298d8eb6b670e90732b735968bcd04b
SSDEEP 768:SRKnsz4/sBcIkyvCJCGCGCUr4wrFYwaTmWUcjDHEWBWRaUf:SRKna4/sBcIkSerrJNrWoUtUf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
2636	msedge.exe
2636	msedge.exe
2608	identity_helper.exe
2608	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 1140	2636	msedge.exe	81
PID 2636 wrote to memory of 1140	2636	msedge.exe	81
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 1488	2636	msedge.exe	83
PID 2636 wrote to memory of 3112	2636	msedge.exe	84
PID 2636 wrote to memory of 3112	2636	msedge.exe	84
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85
PID 2636 wrote to memory of 3568	2636	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8fac0e203be459c57aeb6b54ddf3d47c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb576846f8,0x7ffb57684708,0x7ffb57684718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5665864953486990913,10409117960766082541,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 0141d1d0863244c9e80c2ea0a8c33fd285e3cfbda9926dbab4ff7f849cd95155
MD5 3489f543752d479ca716630684ce5079
SHA1 aedaddf41442306492f1abfa0656a95cfbb8219c
SHA512 6ec4027979ec90d1121dfb150f228add460351702ba17c4a4d196843046ea3742914fe790b7554b713dbd988edf083b4c013edefd5dca43b561844b0398d1499
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 3e9a5879e966e074c7894b63370b0ca04a52a170214a982789ff91477cb37576
MD5 f5b8559692a0def36770f013de3d3e23
SHA1 8a9a5078106dd24829a66e32c1950153c1bc6f63
SHA512 89f4fec222cb3fac7bee8f4daec2601f7ca7afa0a63049a9750f366c41580e9cd644c8d03a107661a0c553307ac15749eb26cc86f38618f1f00a1aba4a732424
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 07fcebfaec8a9904691fd491ab165dfdc175d4aa8117579a218dc1debd021303
MD5 1464a9d0242302f018b566c9f30f4579
SHA1 87df3f9794ab0b18f74686b74ca0082c22ea7d42
SHA512 5a466b417c73d269cdc1186d042fc229f86c11b04cde11178cd00df8463ccbf388cf60d501a74dcc9382ff44bbf93158678b906635c7ddbb02478518db7d9bca
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 66e84ed1b4c303af115d9866a882718dcfbdecc5f6c98812f512dc4ea434b080
MD5 bee83b90fd948f830be2b3024646e8db
SHA1 62a6a9ee8b9742c61200aa05688b294468d1009a
SHA512 9847966a1c65de029762676cf84e6b18152d7f1d75d5694c2964cb73ad80b725e105c5e46f12e8514fe149742bfd4c5e089dd35e28de5535fe4e54654a721e75
SSDEEP 192:niker3XGWMY6N+go9Rv1MDAVi1S92pCxrg:nijrmWSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 da803e1f6a8ad4cf71d4dd58fc97dec4662f52621de05465131fb2b57f916ffa
MD5 ee6f67ec1c722842db5a754ca4a528af
SHA1 1f624e3c22cb7c174b8209ed2841e4332ff04774
SHA512 e6819a2856b6c7f5472aa11d11fb8403e5fa0ed996cb41fad443524c4f3d355b56d83aab9afc878e972c34bfb30c158eb8c83692e5d6c9a217bf5c4d67c1df4c
SSDEEP 96:nikM4L1133XwpvWMoiVmdeHp1kcxUWQyV+VDCziEwb:nikjnnXGWMXpZxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 23494399779afed20e95e6c81c33d6f13d9a438d575aed5af71bbc077995709f
MD5 2548df3dfa23b65d68cd75648676f474
SHA1 4f85f9daf9c907969595c5e984dd13f5f97f4a51
SHA512 bab76fb1f5e5281ef74d6c91b7e498c3c61ecfe8813daea1e1af9240dfbae2d9a1df10426c4f3dac9610a05a421801e7f6db29f3e349fe1fdf041d566b7def63
SSDEEP 96:nik34L1133XwpvWMoiVmdeIN+gVjRvzEDMK2p1kcxUWQyV+VDCAiEwb:nikennXGWMYN+g9RvYDZ2pZxrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9d59c7f1dfed9a28e93571621b210317799c52c8a6a060afae5a56d3ca0b328d
MD5 46a399eb1e28171e7c7b2921138ff68c
SHA1 4a07c7c92fa8de67fbd13b03db2d7b1b11aa98dc
SHA512 f314a2f3dbd672404c8ca9d9d545470bf3c8a1f562f35e45ebe4aabfcbdf4dc622a57d361713ebc38a9b74ce5690e4b680bf2e1c5b1358cb4724133562b3c6b1
SSDEEP 192:niken3XGWMY6N+go9Rv1MDAVi1S92pZxrg:nijnmWSA
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 539B
SHA256 f8554d375bdff355557014d45c34714aada8339b09543cb6d6ce11bac5e61d1d
MD5 8e297f9b280a5137e7a8873cb0b74c2c
SHA1 c418f7290b34d97bd3444f86e6d71ea0bf3f41bd
SHA512 42f56df1136eea2222617611737925aa3b306473d41ac69f64ac083a8b6566121f49ab319c374bd5883b4694cc5cb63b975589e65b00d54e28c7995158f455de
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57bc1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bc1c.TMP
Size 204B
SHA256 f3b4d7d3a7c7740b687b4c538c32bf0d560f96e16fe390f25ba0ec13401350d1
MD5 439532add6f0242767c432ae5b8479e6
SHA1 e619fa46fcf36517f99e7debdf94e9101998a162
SHA512 505e5d356b0489567f6de3acad861fb6b5369640e5bd8d81f2ec44446bffdcf21764ec19ecf0c7a56f52d7bd30d9e3b2b88d33a8d2c4792cd7b6e55e6b6bf763
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 07985a8b885100ffe5eae40ec7b62bea8d447d3893a166732006dc72d683b0dc
MD5 ff6015f7b3be9f7c18468d01d50506f3
SHA1 28e6733cd0828aa24b0c1914bb5197c6dbaf43d6
SHA512 033be608f89415860c8f5044d76efd1d54484c47509d7b51c6d5d4526f6cca7eaee769a9837e8de0a9b024de4d82f9f8d97e736873c3e4ccb71c255df1ab30eb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupb72e2RUPo5G3z2OMDCRHqT:A9iIxuERzA83h09RZxYbUJGaOMWRHqlJ
MD5 SHA1 SHA512 SSDEEP

Submit Download