1b6cb121a711e8bdbf6f686079dae1f086d65abc6adf8d4204ada42512357e52

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9189677b8aac263ff00c5cf85f8e6ad6_JaffaCakes118.html
Size 51KB
Sample240603-m4pnaade39
SHA256 1b6cb121a711e8bdbf6f686079dae1f086d65abc6adf8d4204ada42512357e52
MD5 9189677b8aac263ff00c5cf85f8e6ad6
SHA1 a5561c8d430a8a7d922fe4ca1b8c5dbb54da691f
SHA512 4765f3a1a398c1b46d9e4efdeb02d0bdc84aa7f0d0b11b6ad54dc3d1a4a2398d1a78e969ec516e94727368a64907fdef11317007e05212532fe8e2139625baea
SSDEEP 1536:tEijZeqL2EijZeqLdUFAdqObEaFwK9vqlNZ9C:tEijZeqL2EijZeqLSKdRbEkdqlpC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
1852	msedge.exe
1852	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4276	1852	msedge.exe	83
PID 1852 wrote to memory of 4276	1852	msedge.exe	83
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4876	1852	msedge.exe	84
PID 1852 wrote to memory of 4640	1852	msedge.exe	85
PID 1852 wrote to memory of 4640	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86
PID 1852 wrote to memory of 3656	1852	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9189677b8aac263ff00c5cf85f8e6ad6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb4718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,17604827826578908499,1664975459278193367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
MD5 f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1 df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA512 971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
MD5 87f7abeb82600e1e640b843ad50fe0a1
SHA1 045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA512 ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 dd3e0256c7f83c60b802554412ba5428e6517de9e63e9eb1cd27c2e5a1090e63
MD5 67a49517e9b5b35fc74d95161a0b5548
SHA1 3d19a19996db0dbb2330d2e40612f4ffaef42b9f
SHA512 975e170d674a0a0ab8ce22059dd87b95c94b202bed672a4d02992e0b1d7879b886fed24e4a49484469b0e8a3fc35fb20a6da4bc803332e768bf6b36daf0864f6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 705173074184bae6e0befcce278797984a42dd79d12cce644629bfbcd150968c
MD5 2239db9a9bb56cca2e52483d7daa5343
SHA1 0cbb06c511bb609963e91559562e8af47861cb21
SHA512 c9a8ae5acc31830e4f859c828c5b623466beb47b32497da35bb9c3dc6ac0c40b18af14a3ac6df48f1e7fe6abcce4347a7bec68594b63e198d97c90402a7ae6f9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 04cf356ee2c5b1c22f5dd128995be0b2ca64aa672d0e404a99b9b062bf175932
MD5 2645a3d8bf379db8f09051a05983e82e
SHA1 8cdaf599899503f533903d8a8a7597898c643ccf
SHA512 3246f1066527e30a3dd3dcdeec2d2654f27cef22909691e6270484adb0245d1a769207bdb414f4e9400201da4e8ed8de6ab15f6a1fe14ebb0d0738844259104b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 fafaab28856c3fbc176ff62d5e546dd65f5998f6eccefc79608a9790e41bf073
MD5 8b5877c18acc3b411ebec160948a2e68
SHA1 9d7fa479cc4a9fd527185b030e870893a3e3e76a
SHA512 636b7605f81a0c40bdc6ad52cef80ff4bcfd467c31b89b3c9e0499b16e8a780c2563aae11a54213628f3f48eb91b66cd76db90b74ab5948ad9aca67226081a67
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 04976e4f385f30601a2589f85e0a3c434c16fa9c9be17b16b554db46ca6f7c81
MD5 78d36a3dfb9109db08f75c593e59ff3a
SHA1 5e3d3c9951f87dda573e199456e9285dd267b13a
SHA512 6ca38493fc806faadc224a3b8a22ba8437301233e2fab109d43d4d3e074d7448bb5b12708da49df4884c72a0e3ead1f7162c0541ddbbe95d2b27d163105a7e74
SSDEEP 96:nPkWX1mR0/L0wpvWMoiVmdeGoOAxhOlHA2/z0mJUWQyV+VDCAiEwb:nPkQO0/4GWMWoOAxhOlHA2BJrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f983afc9d7fd95a6ec52f7547a487354dfb7eac07cad394c06d79ba6c01fc0dd
MD5 655097cd227e3396930e4a7541650f50
SHA1 c44d73469a40f90d2fa44a09398e68a3601a5ab3
SHA512 295fbcf747a71e2d0bc519becee570b45c163dd51401c83033afe2551574a6a971ff36e0b72b333eb5f0d59307f484a967dcbc15fbaf6a5e7182bb141a0705b7
SSDEEP 96:nPkfX1mR0T0wpvWMoiVmdeH/z0mJUWQyV+VDCziEwb:nPkPO0gGWMXBJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e44af294023af47e8f31facc67c9a6c979dc901c6b6bceaedf15bb90578e23e9
MD5 cd105636f053cc7009db9d31fa48a8ae
SHA1 640010a27caa81ddabf0a1358aad9d025155a311
SHA512 8a1683852df5de394f05031e5fbe402d72f5835463822858d96ef339f4d0371d35e46ba434a43764b08c93786d20dbc87cf8b4d2bdb0e5c5d3c4d232659fcb47
SSDEEP 96:nPk6X1mR0/L0wpvWMoiVmdeGoOAxhOlHA2/z0mJUWQyV+VD7AiEwb:nPkMO0/4GWMWoOAxhOlHA2BJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f32012afb81cf1ba9acc90a8196b1779aa6aca39c827339ba71b2a38a53f5747
MD5 5e4369b88414118f8bdddad8b91f54b0
SHA1 57cde779622ff7673d9960674644e2dc52d3659c
SHA512 8650fd5078ff251e9ad2ab3bbe1148287583cb2a25e460905369180ec75c7af9b5172a7b6aa247c7170fb9b8db39930c60024ec5d039e6ce6e0b0745eb35bed4
SSDEEP 96:nPk6X1mRQ/L0wpvWMoiVmdeGoOAxhOlHA2/In0mJUWQyV+VD7AiEwb:nPkMOQ/4GWMWoOAxhOlHA26Jrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 43a7b577d24962659b9a871023d6a8eb50645d7318d248e6adfd350d2ec7fffd
MD5 bb57ea8e1cb28eb75b5b3021490f7d2c
SHA1 a3209c3a1c726d79028e7a560b56c6475db36b13
SHA512 adb003d4d9973196e8e2598a8dda90f91e483789322036d7b48a0380489010e8142c9dae5cc74348334effe4e805352ee9b67d5d5ae3c8aa34d99fa0dc8df1dd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAWvRe2RUImyb3z2OMDCRHG:A9iIxuERzA83h09RZxYA4FjbaOMWRHqx
MD5 SHA1 SHA512 SSDEEP

Submit Download