7e36f01ee219a29179e46b2d100c932655a1b7e4d15c3bf690b07156f69e95db

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
920f156216c999802ba88fc48a326cfc_JaffaCakes118.html
Size 175KB
Sample240603-rewshsac95
SHA256 7e36f01ee219a29179e46b2d100c932655a1b7e4d15c3bf690b07156f69e95db
MD5 920f156216c999802ba88fc48a326cfc
SHA1 f0307c75ef6b7bbfffcdb6c635fedb07706c57a4
SHA512 610a564a2be8578d30dbccda3066674f9506c148ee3401c8684f9ee00ce763360d67ecfcb6ec88f767a32ab648aa7a086d22f32f4fede8becf26a403291552f1
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3jGNkF1YfBCJiZX+aeTH+WK/Lf1/hpnVSV:S9CT3j/FgBCJiWB
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
3284	msedge.exe
3284	msedge.exe
4180	identity_helper.exe
4180	identity_helper.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2508	3284	msedge.exe	81
PID 3284 wrote to memory of 2508	3284	msedge.exe	81
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 4708	3284	msedge.exe	82
PID 3284 wrote to memory of 1680	3284	msedge.exe	83
PID 3284 wrote to memory of 1680	3284	msedge.exe	83
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84
PID 3284 wrote to memory of 1792	3284	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\920f156216c999802ba88fc48a326cfc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,18431035254149941055,17630711228834950885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

7e8109cb-67fa-4bbb-941a-a641b22d01f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e8109cb-67fa-4bbb-941a-a641b22d01f2.tmp
Size 5KB
SHA256 7e6cf4769a5b9cc2a5615bf3c126f61f132d928190d425b4189e2ec4c043e927
MD5 d4d9b4b7afd99d4fdbe2363bbc75e8da
SHA1 b0311cddeec9267b368d4b4e969295ae99a46463
SHA512 c881234d0e41642786af5bc6a499573f3d3e5e4ef294b8c4683e2cb07ba695740e4f24ffd2093d6ce41e3f5985448bc4b099e50524b29632393228684c4dba41
SSDEEP 96:nWkMV12D9wpvWMoiVmdeHpRQJsUWQyV+VDCziEwb:nWkoED9GWMXpEsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 939658b2e4b1575f008134a9704717813e78f229179948c4c980d60af4a5567a
MD5 83bc510138bca4e146fd907836513238
SHA1 4836e80f8f8a2b9b9b8cd359e06d3719debfe07a
SHA512 a9a10cf60a7c1d9797d3cc75fe840c4879a25db68c5b6ef2b4b2ac97e91850dbda4027e157e8da9e6a8ad8fc20a86070ed5bdb29730f554cc22fe40ea870578d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 72B
SHA256 2d6ec1c572d12008258854b89afb317fda5f46bbd8f96abcec20cbd4d71fae74
MD5 becb71fbcc241b77ebc0948cb163fa14
SHA1 237f13fc6fd0977088abc08a48cad2cce32229b2
SHA512 0b445fb035a0f72125883dac61feba4fc92068dd8cf61c151b98d733a660e489615201870b2de9acfa7fe8e95094e66ae2bb1155c85bee10907c809d5b382699
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 619dfa15a7db9aef78e8183e20536a060565d27a4f8dc629f32cfb7278a79e15
MD5 4f52827f449182a8942b371cf3bff19d
SHA1 7f0e6771c94d96180dd1d952883a70b89245f9f2
SHA512 1693e753d615d1744e732533d343fd3eb3d377aec60216bf237ef6b04c25ee6f367ae43bb0326ec8f830f6b35b1a1a75846e7a59569ebc2a1ef011aec3f4764d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 588889dbb9c2504eee9040f39e6d9d2d32a98b14585f2cd416625845a5463d39
MD5 8befa56bd659f5b794a4f09cd5dbb04d
SHA1 d3381526823e54ee778352b5d84dcc44e50ba9b2
SHA512 5829b31afffb716670f38939b7c8c91fe19c4e219e17c5958801f4d76b63cf2187cf70e99fab781ab7cac486fe7ca0d7290f09c9d276f382c05f9a664e8be581
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d9717329d21e8a04ebf09bcb9ec61331a943a79331d11080a326e9a30d1b1ac6
MD5 ed88a4ed20fe66c4013315622ad6398a
SHA1 c6d3ef5e43fdbd2cbcbc1243b4df30e49e9a29f5
SHA512 526514bc4bfa93ca373cfd3700276c2652631bdb733f95ceef09c295e3bfee1361ca186ea8bab1e8d7a220323318e5176c253064a646910d338347ccab46f984
SSDEEP 96:nWk3V1269wpvWMoiVmdefV2RfzEyZDEruE5vBB2pRQJsUWQyV+VD7AiEwb:nWklE69GWMvMFYyZDEruE5vBB2pEsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7abe6b86619e8f6f0363f03525771c7464c36d5e289fe6a100d46cc9904f23ed
MD5 edf44348395a2929f2e52169a2fa5ff7
SHA1 f3fd10f28786da53627800acd0d44c2341fb6c7a
SHA512 75c387264e4eb946db627521da846dc5a3a0594b19b007650c8989b8c15f162979651314b6a930567dcae533f2764810a49dacfed6b2b9bfb750cc09fca982c5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwee2RUMqTa3z2OMDCRHql9:A9iIxuERzA83h09RZxYwACaaOMWRHql9
MD5 SHA1 SHA512 SSDEEP

Submit Download