2b14a66d70ed472707775d47975a063cf103f4747051883fc8c13782387d6af9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a30ab428fbb5bfeab0d968bbffdf5cf4_JaffaCakes118.html
Size 73KB
Sample240612-31te3awdnf
SHA256 2b14a66d70ed472707775d47975a063cf103f4747051883fc8c13782387d6af9
MD5 a30ab428fbb5bfeab0d968bbffdf5cf4
SHA1 6316d24bebfe5798e7e4f935f038c86112518674
SHA512 3c1e8e4d9230148866ab4bfdc2fa3db3acdc24ac9543765b398348365cb749d9b5a441d7f37205fc135d9dca512560758886788c9fcc6d88fabce4b3bcfb29c4
SSDEEP 768:6oOQOASaRVuAWyE9dVdGgI+z12g2WST2/KCC3+r8VFLF0FM2r7hcDO4dV:64SaRVuAWyItST2yCC328V9Gnr7hcDn7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
832	msedge.exe
832	msedge.exe
4124	identity_helper.exe
4124	identity_helper.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe
832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 836	832	msedge.exe	82
PID 832 wrote to memory of 836	832	msedge.exe	82
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4536	832	msedge.exe	84
PID 832 wrote to memory of 4140	832	msedge.exe	85
PID 832 wrote to memory of 4140	832	msedge.exe	85
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86
PID 832 wrote to memory of 3028	832	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a30ab428fbb5bfeab0d968bbffdf5cf4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbab846f8,0x7ffcbab84708,0x7ffcbab84718
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11717794743152832491,10444353789757715303,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 202KB
SHA256 9462da5aa6e2a762b02a24b7305bac86349e5b5ea182d36fd6a163de550cde60
MD5 6a16cbefd2e29c459297b7ccc8d366ad
SHA1 40da0213a9e5ea4cb6948f4a8e92b5e8b97e6cfe
SHA512 6a9de0231f9987554a20208a89c6c802d28c57ecb6f9e95771c94156b65c61ac1e18298ce6d3f0559d3a08052845cc2014dab335e119fde731d745e4857b7d74
SSDEEP 6144:MpsBLK1nTbtBiyzVDKt/evvpW7+wub6zB2FA:RBLunTJZzhvvprUV2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 369646d1637f05c1d4963054dd3b74f5fa042db3a7b8c925686d68a9dd517635
MD5 f8560f1e3e6f0e8b376524f94e49f4eb
SHA1 4e47abf891aaa1cc63bb8816fff2303d70271244
SHA512 fe9a2335f54c15643078820c007208c4000f386d71d73b472132905388cf6612e812ceb7522fd31acfde6ffac6a75ae0c6eee96c19e7f0e557879258cf03f6ea
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 61211a6c8a1f97de19f12ea9e7a58d0f8177a96af3284d29dfe8613618bce3ad
MD5 6490bf8903f44ad0ecfa2d864c7c6711
SHA1 dab5d148750a346594eff4e35c42571c297a863f
SHA512 181015b69534124d16067424a65a247f5b97d53ffe17108f5a09a437bc05a3300cbfa71b4beeef0c2d73db69446f83f7977c990860f10bd003bc4951fd24ddd3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3721eafde0a4ec19bcfa6176515759b8f1c49f6ea91dbdfa04cfaf79e3eb84c2
MD5 d96744e48dcfde39b69b1948bdbc3c61
SHA1 9dd6cd5743c6557e5d60181b9172e76820c46150
SHA512 6ad362da9c52d3b049e7b42f3b65a37eb4ee2d4b4ee63b8d2a7093cdabf28d419bc43801d6b61d1abc26a03ba8a4fa886d3194ddcfad6dcddb26e44c82ae6374
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0938c2f00e5ec6a357851ec58623d9695367217dcf674b31f1c2e187d9f5195a
MD5 afe80e4046f7007acfdd776897ed04c4
SHA1 b6a1d773ad11ea8d74468b6f4d006bbfde820e43
SHA512 e1ffa90269af323219c0bc432787a033df3461bbec59aae65eab1a5d3ad4c5c6c94592cd767b831e02da9eff0cd379f05bb12a0482033a0650a570b2659b4487
SSDEEP 96:nVkVRl1KGmwpvWMoiVmdeH1DoLpUWQyV+VDCziEwb:nVkpoGmGWMX8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7d8c5005f5f59fce2b3babf933b6ab2caef89b8a499da98b7a31a488e079bccd
MD5 60863a69a2cf4640ceb42befba0c7c11
SHA1 b00f73b9549bc3fbb427efdd66d6762114997b88
SHA512 a8e582f0cc3b83c0b1fbe13c08a205d0ccc1d7804fb74edec1fc9506ac3c563db958385377472c58adf384987bcd9446543c09b32e3ba956c97bf50f923c1adf
SSDEEP 96:nVkVtl1KGmwpvWMoiVmdelW5St4CoGAtuv21DoLpUWQyV+VDCAiEwb:nVk1oGmGWM1W5St4C6tuv28rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0b121f6e2759b6bd52524431799520405ed44d5f5fbb80e5fc069d31c77bedd8
MD5 33bce3cf16ef2cdac09624a6e7a15e57
SHA1 821482cf4a77d37fdcf67577b428253301019672
SHA512 5a5f378b41b7b9f190ed987cb6a92b078845f5013e9d3029f84120a51628cdddef412a768bf2e7476a12929e895ddbe75a76ebb420184cca267913852ce3913a
SSDEEP 96:nVkVtl1K2mwpvWMoiVmdelW5St4+HKW4Wt8GAtuv21DoLpUWQyV+VD7AiEwb:nVk1o2mGWM1W5St4+HKW4Wt+tuv28rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 51393256405680c0d683c65dae88eb3fa33ac60ee614f7afe5ddf72847914126
MD5 04db0d385a365ab6aed094a3f63a6079
SHA1 ce47f445286ea300d06516417bc0856e45f774de
SHA512 540a32f26e4866adbb2dd1d5e77bbac41402d924b18ab3600541be80fd1daacd507552937f0dfb716f5a6f8be5f9f0adafc226304e16eeefcc47fbbaa68037c4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5801d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5801d0.TMP
Size 1KB
SHA256 11c39a8118a5fe33fcce6690c0a4c4eabe62a5b6c4fb9652c909264bab493b3b
MD5 36a1e2412c30e5e3c12a90d90d960c67
SHA1 484dc70439d260bdfb977be1c59684ff3298697f
SHA512 8f6b80c78725f408895814e650400b30da89c068a0a27f7331a18ab206186d361f175c53b885e49d6f47a2660418ae4c596365fc8eb0ff2a6bd9df9e8ca40a5a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4cc2f30857af391a0474750510bdffc51dd9267fb2a61c63930dcfcf40186bfe
MD5 e5a1e3bb0cee2e940bcf6993133bdf37
SHA1 370fc504037c854ec764b68714c8d464d98cae12
SHA512 3247354a32ae65f904c9d0595c44017fa90d598bd12b22223309186e9ebba6b6f1eeb1575cf4f0aab53d848d94019a2bb53a46531f7137c8c5835211cc4d51e1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupE5e2RUXSRsN3z2OMDCRHqE:A9iIxuERzA83h09RZxYC5GNaOMWRHqla
MD5 SHA1 SHA512 SSDEEP

Submit Download