84d3cac4a45fa1e9619cdc4241c73fec0d95517c2347bb2ff33c33467c076569

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91a776452dc5854e0f410558bf5adb2f_JaffaCakes118.html
Size 105KB
Sample240603-nvcg2aee57
SHA256 84d3cac4a45fa1e9619cdc4241c73fec0d95517c2347bb2ff33c33467c076569
MD5 91a776452dc5854e0f410558bf5adb2f
SHA1 3976b680c371225e1570ca4c79c201a23f0fb78f
SHA512 bca971b37d463c414f7c452a928cb6f057704411fe0610c801b532386bdcd400aaf401c0722d04a5f30d1c9447bf4d15cb536cd29ef087f3731dfefc30656927
SSDEEP 3072:dDJata5fsz3A29rAHeH2X1dmTh4ylsI0zk:dDJa181c
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2556	msedge.exe
2556	msedge.exe
1308	msedge.exe
1308	msedge.exe
2516	identity_helper.exe
2516	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4044	1308	msedge.exe	81
PID 1308 wrote to memory of 4044	1308	msedge.exe	81
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2700	1308	msedge.exe	82
PID 1308 wrote to memory of 2556	1308	msedge.exe	83
PID 1308 wrote to memory of 2556	1308	msedge.exe	83
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84
PID 1308 wrote to memory of 4984	1308	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91a776452dc5854e0f410558bf5adb2f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf8b746f8,0x7ffaf8b74708,0x7ffaf8b74718
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1352 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,10178228422306344253,2794597140563522771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5340 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 8bc311038810bba41442ca02b2665d68b96682373f881fa1d1ace59ee644a6a8
MD5 9cacf58de48c92ea2c1b4315acfc0b8c
SHA1 c0f27d6a86e02e13440e470ca69716cf3aaeb622
SHA512 8f6bbdf8c793a83231057d3631e379793185e091fd0f5decc31a55df5f8bf2bfcf808902f2629f69dd0c945690a4d34e5f9acd2965b6ec345690d78531a0a1d8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 5f7b19d1f7f7a47f3b491f395a9010e0b93ab5b9cd87f97b45934d147847d01d
MD5 f043057acd217bbd96d9e2919e0da207
SHA1 68bd5a8738ec4f707769345f8ff7eac3308b9153
SHA512 e5d069410ce31726e709cab65a391a222b5afee4658bb137b3b570bfbc0e9b812ece4aaa2d012accc08aae15a4dc3dc65d79d62cf3ede174ad218fcc0d3d8531
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 41aee4efb57ad0997faaa148d62a3044dac000056c001fd2ccc1f4581ea1d7cd
MD5 1c2ba9dbb253bd0fb0fa1707ac8a216d
SHA1 b638fb8f43071559fa40f9dc1e44769c1d31e579
SHA512 b83a67ef4c769dca1e7de9d2d99075cd3c26dbc80f378e92166242a2bd7c81895b17334d4944591edb4ee5c9aecf5ad55b3c895dafe323ae7c5947ded29b7a04
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 7ddcba421ceb058cf9adb413c5f3d976f7486280826d03a318202efdb08d4963
MD5 a206a11aabe302e6eb71fe61ffc7c0ef
SHA1 cfe0b8bafff6b7056caec447623da916d3d7aede
SHA512 4935c4e697f87671000540c8a5040cd51190d292a9ab6eaef4a38aa547aa5a208ddb21c5ff493480b9ea9d9c141c9e18a8d6862e614d34914ec4754cd4f50680
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ac907399334be10ba6f48b2775e133a9fc21904f01ae016e891bb737676f7710
MD5 26581e8f9eb44db5a7599b05c07a73f6
SHA1 ebd1303d6d9e044d75ef3faed180301c08a5dae7
SHA512 a02c26507cb3a910f8d5db49ff9223683f2555d6ce6a030014acf827b76e0ff6bf966fd97770b1e92653a9a812a44f96826db0a29f0cd534c37f1e5e400163bf
SSDEEP 96:nekMm135RwpvWMoiVmdeHm0UUWQyV+VDCziEwb:nekrh5RGWMXQro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9084331f8ab81015b42416cf68dadd9a16210d2faf79c204265834fab7ce4c27
MD5 d335bde3eb886c62cd86b14f0c4db674
SHA1 b3337fc7bc5e50175795d8e5ac8a620bce336f39
SHA512 ff1d3fe124fbccd92ed57bcb9f6a597066f8b14288097649cafe2de62ec4caa3bb2cb06789bf648942034c928dd199d2ad9df0f40cf9c1d2266268f0e33adbf9
SSDEEP 96:nek3m135BwpvWMoiVmde8Ncp8j5Il7DzE32N2m0UUWQyV+VDCAiEwb:nekWh5BGWMsNcp8j5Il7DY32N2QrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 eb13ba5df8f48a5f6aedad636a2c6f35c633947ce7d969b5c6c2477be03431f2
MD5 34e60dc694022e50b32ec5b8e9a5b88d
SHA1 021994e1dc1002707909f8dca352352d0d58b4d1
SHA512 b0bc8908a0507e5293f3d6af84e8c3c3377791c729ece5333945b02bc9489cd2454b5e59bd77af169b9ad99b03dfb6fc2dfe4b9090157183dbd6fe6c57190171
SSDEEP 96:nek7m135BwpvWMoiVmde8Ncp8j5Il7DzE3Vq2Lqm0UUWQyV+VD7AiEwb:nekah5BGWMsNcp8j5Il7DY3Vq2LqQrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 455f243ec3e07d2cc653cb5aa3de1ca09ec43a25f2572db36c5668916d9bb268
MD5 4aea45590f005d70ec2a3256637d5a32
SHA1 4e528b428304a601bde8cf92146e5a605ff16318
SHA512 b195c2870cc07a6f222abc0000cd492f9a1b98f26dfa9923e3fe3fc0c39144bb58e44c6a10ca52e8745deaefd2b5cd4e342e4d64b40bfb7b15dc607756d3fb30
SSDEEP 96:nek3m135RwpvWMoiVmde8Ncp8j5l7DzE32N2m0UUWQyV+VDCAiEwb:nekWh5RGWMsNcp8j5l7DY32N2QrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 0e6be51c52947afacfc05ed467631b91cdb0d29b6dcb98cb41482808e908591e
MD5 2151dd48185da84e844d63a1d908f615
SHA1 605ba9ad20a76afb1e0684782d4483b2c3e3e720
SHA512 65b6d4143233b37d6475da449c959aacb160194afbf82126cf19a4f393b099eb91c6aefc1874b72ac3b64e88c59cde7627c5bf250fa589392e3718bc6f953aa3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d8eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8eb.TMP
Size 538B
SHA256 bae2071c81655a5daf413b5ed77080985b47095ddcbd7373ae615122fb8a98ba
MD5 b01f11b9ecc20aeb0e0d1c1603cb289a
SHA1 2612b0bcf61aa0444321eaebc71b26f68bf29e48
SHA512 02acda5ea20eba487dab8d1400c3ac7d076e5a0bcc6f7ea4f28c40638f0ed5417f2fce43a7ab3dcfe4c7ff4d297549cb324b51e672635ff632a10c37ffa6b117
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e8f368f3e88478a05479ccc284ef264f14976de6f026e179dade65dc6cc464e2
MD5 e0ad8a994923280b1eadd7fe1d029537
SHA1 6c98af867ab4d141cc93857c8c41a1166a608fc1
SHA512 35842c449149085099c21efe2c09bb8fd8ad1f6f77e8886256b51cfd6ae2b1c4df86f4e6d4ff25c638f8bb2a5a639949f6bf32c6c8813540d691998ad976598c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupx8e2RUK/XzS3z2OMDCRHqZ:A9iIxuERzA83h09RZxYIZbSaOMWRHqlb
MD5 SHA1 SHA512 SSDEEP

Submit Download