1d38cc6b1e77f456f7401a7efae75f1a98ef9e10015ff4439d064ff9a29734eb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 02:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a382a5e9de21d51d5b6e18fdf22a0631_JaffaCakes118.html
Size 175KB
Sample240613-cqldla1cmd
SHA256 1d38cc6b1e77f456f7401a7efae75f1a98ef9e10015ff4439d064ff9a29734eb
MD5 a382a5e9de21d51d5b6e18fdf22a0631
SHA1 8864c1b446888b1326f528ecf9c2a68b7bbc62d0
SHA512 bacbcf7217f6ac4bac1061f099bfdf6b369c69422c649586beba532eeb03388565031f016890694eb545bd413e00084168479e1539720fa05e2e968eda6b7d27
SSDEEP 1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3uGNkFfYfBCJiZq+aeTH+WK/Lf1/hpnVSV:S9CT3u/F+BCJi1B
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3644	msedge.exe
3644	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 1800	3644	msedge.exe	82
PID 3644 wrote to memory of 1800	3644	msedge.exe	82
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 376	3644	msedge.exe	84
PID 3644 wrote to memory of 4456	3644	msedge.exe	85
PID 3644 wrote to memory of 4456	3644	msedge.exe	85
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86
PID 3644 wrote to memory of 2796	3644	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a382a5e9de21d51d5b6e18fdf22a0631_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdd4c46f8,0x7ffcdd4c4708,0x7ffcdd4c4718
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,12506859427300921347,6522946892318578478,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 e69ad9bb8d4522ac8d6efcb36a082705082fbf2c14857c8568cc5dae4aae4f79
MD5 2e57bf1a24eecef1cc0d3326731fb2c6
SHA1 79723489d891cf314d8c8a38d75512d171088fe0
SHA512 468d439c3a94e804c8c234f0328d2ec0b480ebb9e8931bf4b681f70a781a03eec0f0c0cc537635e277ebb72f26faa8870bb7ab8b4a281efd801c8a3837a25dd2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 feb65f66aae788758f0245c700b0f3d2d808fdb38adb15211126cb156865a53a
MD5 5fd58146d8bc6c8a4e258dfc3a00429c
SHA1 71576120fdb5acb8422b696aec9507e6b8cdd7ca
SHA512 6211d513bea045e4c998879c3524d6da3ba547ddf9ab5198195540ad10a999e6f1aba1c832e81c1520c5519ad6d3ccefef3d9a9e84e9909a970085bf70ae1ef1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 4059d06e291af2dd76dfef1ac39b4ce67eebf65d1f32ee13d5399687a413d34a
MD5 05ef34c7969d910e77efbbd01f8853a9
SHA1 e5104557e488fcaa34bbecd7110d6e5e152d3e1e
SHA512 64beff6a0b01069ed376dd3dd938ce8c8157c612e34888d931fe8c511a04d1b48669594f8b5c9ee27c684bddd034c683ef3afa8b0094797cdef898e2e88c96bb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b015375a3e6a57abb112115ef0f0344737ff0ce8952f25ac19d5d54433e659c5
MD5 f16865bda196acb7badf7d82ba845a66
SHA1 81bfa5a5b6347a729605af04822bb07686405372
SHA512 3dec141537aa5f4737f6bec593ca01a4d1c737aae2db38cd42082d8fc66b35b941f31a24d9c05a7ef953fb50a4e6992a7d15bb4647f8298cad2e0374dd369d0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3d2788a0226673ab9816832a830464849a8f35138868cad2ba4adbe2cc9dbe9b
MD5 f8072d1658a71700c8a2a100af036539
SHA1 d36726d9ba8341efb791f3f0be7ce7188f6212ca
SHA512 ccd66ec8a1aab0aff0e19363ac955bfd7ea66f05c4fd81bc489231f8d9b61f1793c99fd47dfa8c4b47140037eb5751800a3dfc745bc28052b6fc53de97853a34
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 76abcfbf43b363a2a096db0edde310fcacc459cce62ebca50c69fe5d5de63aef
MD5 d0c5a1afd74cd83afb21d807d9535e67
SHA1 6afed5c40e2f1284036d5d38d1c69645bbd979cf
SHA512 50a8ec46697aee8c477238cd9a3daada94c9c66c91be7c04a40bca881cbf34439438a96960a2180c4824b147046723c95c79e087e681f743380452dce8a410c2
SSDEEP 96:ngkloxm/DQYmq319e/wpvWMoiVmdeHgioDUWQyV+VDCziEwb:ngkPIYvQGWMXoDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0b3d025f22e66cdd78fc879c0448ee2c344717d118ff73192e46828be7fa06ec
MD5 d90c0c504ffc0c41e79ed69486eab385
SHA1 7810ee788b47f3690a774f37fff677e6ccc0b416
SHA512 4a9680f360ca2cd329eeb7e2e55f933d5d4c93c7ee1dc5d10a423c26472aa458f70e0d2904dcb84afea1b00ae4a8233f2d42d9b79c2f4eb40af3b02a5223b8b5
SSDEEP 192:ngkPWYvJGWMuq8YV7cErKEK1M9W2KoDrg:ngavsWkHr74N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d0e3a31069c42b5fe22624547df4a659f014691e324fdc1cc23e3198f84f3719
MD5 28f9ef788bc8411831ed52673c891d5c
SHA1 499e2e47418e5a234f41f4a8c748bad09310d502
SHA512 451c8c1ed5d692dd1bd647c2e4cb9554381b1eb7662d0498cd044ae3557e3ad14a563b73d7840acb64de37bef6b2ed5a445b512cc27f19a3640608096b1e4614
SSDEEP 96:ngkloxm/DQYmq319N/wpvWMoiVmdeqCKV/4RcdzEVErKW2gioDUWQyV+VDCAiEwb:ngkPIYvJGWMuq8YVErKW2oDrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b9dedd2d67bf8a5411eee871b6831e67af6d9d90f3f8b0553ce061aacc78a1ad
MD5 750d517757ddc7a45eef5ff571828f01
SHA1 e6f5a9981f6a0db2a58c272df177eaadd7aceab1
SHA512 9279536a02d5fca430cbb12b01eac5f47bbe77f5873c1cfd2c70ffb3afa758d0e2c4cc6e2ff1675a659e5d55782bae98dcbd8c894b26babbe4476783c6fee553
SSDEEP 192:ngkPWYDJGWMuq8YV7cErKEK1M9W2KoDrg:ngaDsWkHr74N
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 3d608014f909eaf9acf89370f18da43beb965ce967601a4295dc5f19c6652b03
MD5 31e0c52f85a9fcd69b0d303f21b66e90
SHA1 980fb7be8f7bfaea000b3e9be19390ee36569b5f
SHA512 2129b1086a33c7785340b7eefc6b48b5df5211ae6e512e5d7667331b72b849618f22faa2c9b84020e9a35626a5e6e63081bef6959eaa3f3c435a323961ded8ee
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58b541.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b541.TMP
Size 204B
SHA256 99b85193be5303e18ea0b96bcdbbd64878a9e8953a776272dd9e5914d022a155
MD5 3d622fc2d287fa4413d8372d6f38affe
SHA1 8d520994a11bede5a14f74b75d02b1b126332d80
SHA512 e3320f3b69a5b8128114b38807db1018b738fdf21d213eedd05e02c967d8bbc13026410fd38bdeb6c62c68725aeb0466d7a36041835c4592c2a47a8f783a4d35
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8f13e0ea582b345c31163b3af8911a97b065fe1b7d8171b787947e02f8e2419
MD5 8ed4cdc3a745b1f680661986e5007fee
SHA1 45190042250c2ea70026b25e3e88293dea8a9b65
SHA512 3fab6ffc1c712aed785a93bc2cf24946e94a69a7b7c53695cb482a232864f0cba6f7fea3238fe41290c9aac323ace7eb9b0452d9d89d3de1ad32a87f225fd17a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupf29e2RUO2k8n:A9iIxuERzA83h09RZxYuZ38n
MD5 SHA1 SHA512 SSDEEP

Submit Download