3ce1575997c47b009cc112c00c08f130c52cbca11a7bbc25697c0adddc22e234

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3fbb3289c7ae436023f0aab25648a66_JaffaCakes118.html
Size 72KB
Sample240908-kvbc7aygkh
SHA256 3ce1575997c47b009cc112c00c08f130c52cbca11a7bbc25697c0adddc22e234
MD5 d3fbb3289c7ae436023f0aab25648a66
SHA1 67018392735b39e97df19b9a27c0abc45326095c
SHA512 55f9948fd296ed9fa9417226b4f93517895000fcdcc77bd914f70b4b22fb3460cd675ec47b57c6d03fe0b9975a681f0ab051c4be54112c653e8a40c4b3b6a912
SSDEEP 1536:Nwgr8VkeO3Px969y/QIyjwgHekjJIh16aS6cgRrwBp9L:ZeO3Px9ay/QIyjteIJIh1vSBp9L
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
1724	msedge.exe
1724	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
1692	identity_helper.exe
1692	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4720	1724	msedge.exe	83
PID 1724 wrote to memory of 4720	1724	msedge.exe	83
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 5084	1724	msedge.exe	84
PID 1724 wrote to memory of 1324	1724	msedge.exe	85
PID 1724 wrote to memory of 1324	1724	msedge.exe	85
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86
PID 1724 wrote to memory of 1360	1724	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3fbb3289c7ae436023f0aab25648a66_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff305346f8,0x7fff30534708,0x7fff30534718
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12572396614700176930,15399235538620908741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 23KB
SHA256 1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4
MD5 33a83c16527e4531fbfca2631f653674
SHA1 87a63514c262ba4bffc52d2ceebb3ca14353507a
SHA512 f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3
SSDEEP 384:fmkqzlgw4CtpJByzHvyMPn0cdWgrlF1xUQNaASTJJlqC3Ix7RQLSKYfkXZzauNEp:ftqirs1yZP0yVn1+QNliJJlqnx7epD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 45KB
SHA256 02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a
MD5 aa6a698d1c7fc6d35265b10af5570e9c
SHA1 00da372ad4964a5d5b8afff7fe1b207ff284f232
SHA512 f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b
SSDEEP 768:aAW22hCNc8zQk/uhLH3Eh3GOAQ4/V5YjDdt8ln7afnMYJNIyQfPLNAZNZYo/6v:aAWbw+k/uh639Q68l7aBJ/6BAvyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 264B
SHA256 decbfa24192a8bbd9e18d34a25c9622f4d300152c9e9955541cef0bbf16ecdaf
MD5 27132b0bf540dd2a37847fa8a91966ef
SHA1 9b956a2a1aee652d3361c58f556b83fb1a6c6edc
SHA512 1742e6b5364e04721f0a457491b56d7f3b6b95a56dcdb450d698afa452fe309c8d097fcccb9f92495995b4de05a5d3570cc80b237a438876fe1d6e25786c7fe4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 a1ec51ffdd946f028d12238b03d15e01bb9f103576b3c0ac652b7694edfabdc8
MD5 7cba9a580c3dffd1fc9e8e3d3a3e6b66
SHA1 2e6adfb8f71b3baaef37c161206398af015e6599
SHA512 affc97ba03189acf3db83137233376e6450a98fe2ae74ae32408dd2d4e90ec904922d71e28d55d8df3158a6e3c4a5f924e2ca58160ccad846026387784594665
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a43f12b845a3746dbe5bcd96a85933991bb42c7bf4183bab1fe182fb4159feab
MD5 e51362b55faab4ae012424289fae4ddd
SHA1 fa31892d7e5adf5813c45724ec01734372c96650
SHA512 f1ca1539e5dd45c7829fcbd31e677c79494842f6471a31a46ba798560315729bbcc6e8c2c427a9f20693b061a1e3a702a60b67997bcf510e14e0c09d889cdf2b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9c9c6bc75d46336989a89fd7a33c7dc2322b510ce81fbd0675dd34bd45e6227e
MD5 81e9fd9c04f7dfeef67478e53bb9ca99
SHA1 31c29173c6392b829d8ac38bcfeb5520cb03ebd6
SHA512 b7f81e26f95567d2e0892941e774eb9128f97aae6e488e7e6a659b92a664fc0e03ff34a57de032779cd37502764f8bbf6062144667b398ceb72d5f9957b1be22
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2be17224e59a625e93d2ac2e0bfc3a0706b4976746860391ef4aaafd95bff684
MD5 001450eaea1fb536c6f3b08187124f57
SHA1 c7846666788dab9a16c1fad75a2a184c678debde
SHA512 7406b5211592ac77af0ce9f7550e73581c55378e8488e392abe55a04adb2b842958f009fb985adb7d8d817f8f53326683c28c5d697c80367b7944e8c8680eb4a
SSDEEP 96:nzkRXD1lnTNwpvWMoiVmdeH44YAN9UWQyV+VDCziEwb:nzkRTXZGWMX4G9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 749ad0c6a09db9196efe8e9db5db46b1bd74bb635bd8f9a0df9720dccdec0ee2
MD5 17890100d621e38d5d86780d89df27bd
SHA1 3f27472938604c175d9beee619f03ee145972d06
SHA512 d2eba23b785a9e118b537f7d4ac4145790f4380bf9b2b1fd59c6dd25dcbc7fab974a7767d0fc0ccbce768ac4b341aaf3ac83a1f83d3f8c43092655c2de2e7b3e
SSDEEP 96:nzkRPD1l/TNwpvWMoiVmdeUek5MkZOzO244YAN9UWQyV+VDCAiEwb:nzkRrXxGWMkeSMkZOzO24G9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 adf746f2b62f517423475cc31dc96f75d47f50e4951ccba65d703a6ce8ac2454
MD5 f5fd4f2cccfc83fb8904cf401a9bb1ff
SHA1 159cc3d9401d9c1914cf906a8a1ad7d51f30b158
SHA512 dec97ea8ace5b70078c203b855d8a13a919691d3225b7d25b8021643e6e3c40b15ac9cb5ec67ce92fb8a497374b5ad1c2cb2b7f252b47763b55970e8ebbcc5ec
SSDEEP 96:nzkRPD1lnTNwpvWMoiVmdeUek5MkZOz244YAN9UWQyV+VDCAiEwb:nzkRrXZGWMkeSMkZOz24G9rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 04d32d018ced95870ada5f68c5c9cf5792b14bd4e2137d1c720d907d4e005b1c
MD5 9312e99fd12187744020ca7c76850119
SHA1 e220bcd572a3fe3270d57993418911148bb2c609
SHA512 4c6081fa55746ef4d21d138f653f99832334f1f6ab7b5d68fc906169adc5077abaa58041e991cb7dcfb34e85bc71c9e81cd6c79d4d3beaf8e84bc802163c4d64
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581865.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581865.TMP
Size 707B
SHA256 9f4f478c7ccb95fa1b2e25cea6d953dff714a0c5ed6ecaf571bcb63d5fb33061
MD5 0b1cf7ae7b2dc93168a663f717cb1028
SHA1 08db5a020d3c04f4eaf19615085865e6499247e6
SHA512 8b1e233094548be828560f9cd35550288b634ae35fc6f96c4b3546ec5a2319e0e507ce6860bd7350eb917cd9d1109c30d256f5b156a6e35cbbed0a3f464e03f4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f3ce55611a8e24b826b6377e5d47afab9f91ae90bf5a013f773d07f78a219537
MD5 12c57d714b6a215be116f42026f181b0
SHA1 b69abe93b323ea1602cc5a0939cf21e6497ccdec
SHA512 ff4a5620d25b6e6346c41100fd7f221d690971dc7dd68a7c91ede281ff5b11c7e622684b3c9deea0ff698d2f8813a9307cb922c5b7c05d348dabce127395b173
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8ze2RUVOkgNLQOl6feAOyz:A9iIxuERzA83h09RZxY8j8gNSrz
MD5 SHA1 SHA512 SSDEEP

Submit Download