4f6bacb99a6bb89cf0a01b18f8b100cde424d00b552b2e2a9b5eaccf48997967

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ce2df145c804ce260368a807f5ebc877_JaffaCakes118.html
Size 62KB
Sample240905-3t1wkavcmp
SHA256 4f6bacb99a6bb89cf0a01b18f8b100cde424d00b552b2e2a9b5eaccf48997967
MD5 ce2df145c804ce260368a807f5ebc877
SHA1 f49a9fa82a0a8474e6c4af1828ea568197e866fb
SHA512 4269bc5eff38538eb1b4ebae9acf5f906aae0111188f66a4adb266348698d5ae4188d064f12eb617f740ee63f4032151f60785877ad82f05ef30adfc5940e78d
SSDEEP 1536:Uz0wVKJ1Q94JQL1qAvDCsfry28hqlIj8Xua1MZduDJaPvfdHRxuzae5bQZtjA1:Uz0wVKJ1Q94PJlxYzdOZtj2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
540	msedge.exe
540	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 1700	540	msedge.exe	83
PID 540 wrote to memory of 1700	540	msedge.exe	83
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 5000	540	msedge.exe	84
PID 540 wrote to memory of 4904	540	msedge.exe	85
PID 540 wrote to memory of 4904	540	msedge.exe	85
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86
PID 540 wrote to memory of 3168	540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce2df145c804ce260368a807f5ebc877_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d48d46f8,0x7ff9d48d4708,0x7ff9d48d4718
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14995308021711682854,2640950459401323400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 23KB
SHA256 6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8
MD5 a0423f1305547bb6b8f5a4fb1a9fc2d8
SHA1 092dcf1fe57e6bb53821eb754e04188ee70602d5
SHA512 b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3
SSDEEP 384:aAW2VTWfhCNc+bzBo3WuAi3FwN/f25rCT2LduMZ6wHWPbcb1xDtun1GrR1+4JdNE:aAW22hCNc8zQk/uhLdue52E1xG1QCkPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d20b02bc46ddffd8bfc54b5e72c874b83ee745962bf5e14eb2445a56bffc2300
MD5 593c69ae51bbe1fa9c67977400b71850
SHA1 7af77156908791fde0b9bf233da0baa75503feb9
SHA512 d65474fd136ae93f182229ffdf9fc208e009d7943e5c887cfcf83e5aac67ec2da231ea5edbe78cabca8f8c7b3f261444e76ff833052a6bb07e53730054d9edff
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 ae19c8cdff07cba19bc10180eaf3afa48c2b9f63cb639c1a8a87bf1d906b5c4d
MD5 969f872361346838c91f9437d01ea0cc
SHA1 d6a5c251d98abcb8c0e08f4b5166d459fb3b691a
SHA512 a1566f0238a706abb35a97b782d0bf51d360940b40a74337d2e8ce65daf1809f417aaf2f929eabc29ddb054f6a88ded435f06d528e88c7d0b49836c78252c9af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d12c9c4ffbda37a9fbb70a315815ebb21bfb93693a7394701d875720b8dde2d6
MD5 90de374adc69a311ed92a69fb51fe91a
SHA1 d833c795d5bf7d4f672a4d73dd64c5f3a6ac4095
SHA512 496ff236438cc66d16bd685eaccc0950b12bdf451284284b68b81768ffdf90edcaa09792d02d6316170993c9e37c7a8916e0cfbe3939f7d597bd1345050be5b7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9a3ff711da47a42a966d947e00106da3e6e5c06981ced0d4292cbab61b4b40f4
MD5 2811638d484e45dba633732ede4af85d
SHA1 e199fb2cbc46060d759cc386bcc441d562ec8d3a
SHA512 1c3db65c0cd56c6b6c848afd6970810701d3d769407807704d02b2d5f77f0b2444e7a453cc347e2ee91749b38ff57dfa2964d6dd1a311266898081b8cbde4593
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 63695f93b2227323b01d438404bd10b0b0562c0dbb7a04dec6b173553284a8fe
MD5 c5343915be511df625d38cba9ebf251b
SHA1 d2e59ba0f7502dee5a9c00dba2db78f8931f1a17
SHA512 c72f3b2305a568f696a8192a84d2a60c0e9dcb1590cdfae1c797e31773be581f71f681a72adbf4320b666e6ac5a39b7dec7bd97a370357017255719efeda6615
SSDEEP 96:nvkRl51yRGwpvWMoiVmdenlNkol2lnlfJl7lOlOlAwlVcflql2k3zUWQyV+VD7AE:nvkRTuGGWM1Nk4alfzBiiAwVcNG2crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b8619213932738d5c87cf23bb11d1086f119c77b50e6852520c0afccff07ee4c
MD5 76a4074b0d43ae310d168775bd040bc8
SHA1 71461e1a00f62128cb7333b8c7e062aa82180c4f
SHA512 6a667d0a444d27178b5650f7bc50713c6f413fafed0d2e846f5b5d726283c7c36a940aaeb1b424d25f2b494f68e0b92017cf62a8ae40fe1228a8441765e723ec
SSDEEP 96:nvkRX51yROwpvWMoiVmdeHk8zUWQyV+VDCziEwb:nvkRp2OGWMXtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c39936175035714f8662fd4a98747f8bbffb2d938aceb3567f79caf26ede339c
MD5 e79abe9019017cf73cf7afc538d48abb
SHA1 233298133c5046bafa470c50f1fd8756965920f0
SHA512 c1293e091a452596a8e7a520a3c1f473b5c23a577a1640cf9b298e29ca71b8f112298edfd2e2eeb767a8793487db2bb1f3d99382de4c6ccb6f5607ec0816ef97
SSDEEP 96:nvkRP51yRGwpvWMoiVmdenlNkol2lnlfJl7lOlOlwlflql2k8zUWQyV+VDCAiEwb:nvkRh2GGWM1Nk4alfzBiiwNG2trV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d0b3e0c01f82671ad15f3aa8b76a19ab1fdcd7934a722baa480ef4f4431af68f
MD5 95afed635b7a6e18b9bf65b62e6ca444
SHA1 e287030eae9c9fa2d13e5998861b267f27d4cde6
SHA512 3bb6be84dfa6af3fa8e12150bad7811613f82eb3d3f546e16c76ebc1acbf6063d975f337ef469fc191da0c1c469b16bd2c44823c6c29c281250067d4d414f612
SSDEEP 96:nvkRl51yRGwpvWMoiVmdenlNkol2lnlfJl7lOlOlAwlVcflql2k3zUWQyV+VD7AE:nvkRT2GGWM1Nk4alfzBiiAwVcNG2crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 94153844d37c2145a038c17b43d4f3f0c28f27b8ad55b5ebcac533da73dbf05f
MD5 8f2df33aef2f877a0f6cc891a024eca3
SHA1 6f29f5c817964a06c37f705e4f891b2b28eb4c40
SHA512 7c0d6bc3b69ab861d14d7ccdea9843f2399ba0acff99b6831d5ba4a2e7367496bcf23b404380fe14ba4e69187c2a739e26637f67fd3e0344c5db2b48551872e1
SSDEEP 96:nvkRP51yROwpvWMoiVmdenlNkol2lnlfJl7lOlOlwlflql2k8zUWQyV+VDCAiEwb:nvkRh2OGWM1Nk4alfzBiiwNG2trV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8dd05c21b97dfc6226b3750def1767436ddda002de7c3ad0dad306d42634d2f0
MD5 c80c2fdbc6586b3c45e96d4397c2ff46
SHA1 8f254537d4445255cf9ce435fe2c850eb718af6b
SHA512 98b538ea2331c6af4ad73edba98398706717ee7b5f333bd54f30ac32469b9d9666e771e5d2a8c184dd995f71cc885577bc38984321a0ac93ac4d391bfdfeb05d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupve2RU/xnZLQOl6feAOE:A9iIxuERzA83h09RZxYXUZSx
MD5 SHA1 SHA512 SSDEEP

Submit Download