33f0fc311d6aa0d25d72d2ea15c2ffe2fc31f8c4e573f685c2eda3f2511e1c22

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d299e15460781c39645ec33cdd9fa8b2_JaffaCakes118.html
Size 59KB
Sample240907-xdhr6aydpj
SHA256 33f0fc311d6aa0d25d72d2ea15c2ffe2fc31f8c4e573f685c2eda3f2511e1c22
MD5 d299e15460781c39645ec33cdd9fa8b2
SHA1 a70dd3e62c1d0a08c8477ddf67b2a675bc2aa959
SHA512 7d2565fb1e7ca45c54769d9a0dfd953b36ebda82707b1e765018322d245e19abb854b52eb895511f74c07928ef6d900cd1f7858b8d9ada9e13430d12616d6f0a
SSDEEP 768:3u2pnPDJXkpjBp7SpCdOTrKfLMRHmBMHJ2Sbg3Xun/u/qh++pmT8LUTzSVL2SRV:3uMnNkpjBp7SIYTeMRGDznSVR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1380	msedge.exe
1380	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 4088	1380	msedge.exe	83
PID 1380 wrote to memory of 4088	1380	msedge.exe	83
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 2188	1380	msedge.exe	84
PID 1380 wrote to memory of 1472	1380	msedge.exe	85
PID 1380 wrote to memory of 1472	1380	msedge.exe	85
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86
PID 1380 wrote to memory of 2240	1380	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d299e15460781c39645ec33cdd9fa8b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce26946f8,0x7ffce2694708,0x7ffce2694718
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1608 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,14165356077968974933,17879031632736825858,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 23KB
SHA256 1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4
MD5 33a83c16527e4531fbfca2631f653674
SHA1 87a63514c262ba4bffc52d2ceebb3ca14353507a
SHA512 f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3
SSDEEP 384:fmkqzlgw4CtpJByzHvyMPn0cdWgrlF1xUQNaASTJJlqC3Ix7RQLSKYfkXZzauNEp:ftqirs1yZP0yVn1+QNliJJlqnx7epD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 154a6c87c2a628776b7c9ae2f051e28b778373da02e0122d4849fc31e3fde47e
MD5 496db8a14eb36cdfa6434a74a68c4a68
SHA1 3418a0034c28d5c3ef42aacf6aa5298e94ec75c2
SHA512 080ecfc9672e396c6c011f5c01a5d71736bb40bb3881a01663858f3a135db87c917d5f9916d5b7e3ba8c5c758f64a1a6888dd346049b1a7a14c4841e4370f484
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 a306b3ed2955e9f34093d3eef0943183edefcdce110272093fb1ffb6947b4b40
MD5 a3e3e3765ebc29e74934bc270527c3a4
SHA1 bf867c7cd7fab53dff7a6814642b8692eb165ab0
SHA512 61812535893f226bcb9322e86eeaa614f2301026d2387fa2706e832d0b09c174fd905886e6eee7de46cf18262d50bca6bd926104914dd91b6d6769aafbefc92b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 6b58e6be4d52e11a25ab7d37ae9168fa40d5937c4fb1d7d570d815f84a6ce08f
MD5 57eb87e86b7cc6e5b05d6bf5c99a5e3a
SHA1 a91e5ae9d2d88867d0545115998d938be068d8bc
SHA512 2e9862e308b24794957bf67249d527c8e56455d511c096d01788e35845a86ebb3b38aa00401e2c6aa166d6729c9203ea6d24db6f6705ecbbf7751c6857498f18
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5d8ff480ea8203665e3817bc7b2ae350cda8a129cc259e77728a806d21ee855c
MD5 87ce2844c8025c501cac5271103ac3b8
SHA1 db3ec8ca0bc1f18476ed335df06ced65b2059c8f
SHA512 fdafb811bd42795f01a0d17d1ced1cbe2f8ca67e22f357da130fa01de14f722aa8f6da41583ff80b6accb6689abcdbe85e553e1822ff8721d115e13cec0b46ff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 0efa9cccc3e2345ec6aa6effd62e5fa7fb4d2b5a5ec588678e770d6758d2c5f7
MD5 db7dba169f48ff63a162450fcaed9f83
SHA1 0cf047bfe423f746d89d8fea54e6d14afb056ac1
SHA512 49d15001cd1666c5d822b7fdc79b2d0d2d355eec471cca165558813ddc055130166845ab65f2679937e8737c3e771eabb4f4d67ac938681ea54505334da9da89
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4c940aa89754268a3e9db92017bec11d5366cc9fe3f187fa1aef0fe11d2c4c90
MD5 712bf9410ea6ab0c19fb85af7bdfbbe8
SHA1 835290ace7240a5b87b732006d4e7a7e07f95645
SHA512 01e412aa8e7c912fd5def8535ca584073f6434036c27b971e08023a44c61f3519b993f93df2f03e5beb856a04e3ea87bd940568a67f58ad0f074517b1a1d53dc
SSDEEP 192:ndTf2kRVTNQuGWMqa1oAVdjicf74nOeA/foOYXw21QPT77rV:nR2cQ/WETh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8f721c8f05bbf1258392423c3b55f080457bd46f6868fcaa512d0f4d72c0eca1
MD5 50cd0fdb6d94d89763f93536eef5ba79
SHA1 4e6fd31073ae85325b56b9b60daff4dd9c48c78e
SHA512 ad77a36544a063a405b7e32a805ddcfbe1a9ad118c546221493bbdb5e0bb7a73cefb7cd25e2611cb705ab89080ffcad7fbede8036409a048380b26988a28fa12
SSDEEP 96:ndTf2kRXtTN1WAdwpvWMoiVmdeH/ddePT77UWQyV+VDCziEwb:ndTf2kR9TNQ2GWMX1sPT77ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3bd6e9246633ff87c1e6860786c811f8d93a0f3ce3fb147cecb27e8bc6375de9
MD5 fb9ce211b4177cb102c6c60a2a607dea
SHA1 79e3ee0fdd5e0ed2a42c31a9ce4005b5a5ac9c4e
SHA512 d6d8037b2e48c0cc2e8af1b3b4e7f26cc41dd552d86f294badcab8875f403f11287b758017570f47750b19c13281692cbb5f6e11994f1c73165dc611216a5d4f
SSDEEP 96:ndTf2kRPtTN1WAdwpvWMoiVmdeaa1oDoOY2/ddePT77UWQyV+VDCAiEwb:ndTf2kRVTNQ2GWMqa1oDoOY21sPT77rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 203B
SHA256 7d44597ba97cfa662bd67ee391a8c4d90a755659e9445b11b388e520d03a9e03
MD5 6b1569867ba01f595517d9bd7c6476ca
SHA1 5c0710abdb7849c49b7f6474760c45c07d10c3cc
SHA512 82d16981461689bfb5bc305a2256060743a3dcde3b984931b3496b37fbbd78e8f05fb34a61db3896ca6c58e7447395bd81715a6c56832bdffa5393c4bd9783ed
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58ea9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ea9a.TMP
Size 201B
SHA256 e332d2545a476cd4b7871cbb59c071bbdde0172908cce22616f6c1a5d557cd1d
MD5 19b1e822eb82c689280be04c9bd5c564
SHA1 fe8b02c9d2ce0025d587f37b7432c934126edf01
SHA512 c594861b60f86daca7e24f0400b3d1caa15e826fcfb03b8da399319a25fbf161dde5df7423d6edb1334e09e300fb81be756e51ef8e0f47466e688285909cded1
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 579f6b7ba2576d8875495585a52889ece72a2ba54610cc7a3a8fb46cefa6c2c5
MD5 f372f7c4e9f3cb10c70dc701d7e58309
SHA1 5b36f0620e1d0eb678cb088bbfbda3f7c4867474
SHA512 f8f991023dabd9379e71d2f5ca669541b94158399c28126b091fd164d4e5ed451dade63c07c009cd0d6cc5166b7f1b20162e6faf6a3c6e1cdb73432fb24eae0d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupX0Ge2RUrMj23ISKLQOl6f9:A9iIxuERzA83h09RZxYRyYFSf
MD5 SHA1 SHA512 SSDEEP

Submit Download