3b8c658a37171b5437e9a1535977e4cc2f72b58eb142e0a699587d2395e0cd65

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9d9107496036568e247ef3efae9b1da_JaffaCakes118.html
Size 80KB
Sample240927-gpshqs1end
SHA256 3b8c658a37171b5437e9a1535977e4cc2f72b58eb142e0a699587d2395e0cd65
MD5 f9d9107496036568e247ef3efae9b1da
SHA1 250ebe072d0e77fc9563b9b03e558d86a316eb44
SHA512 1d582409ecdbafb21df3851cf119b8dbc36d41cc7fd4a6d5d7cda2380a866da8482acd96c4e963f83fb052c5c1883a442e9be2adfd1b433f0bb54f5a90953935
SSDEEP 1536:iYkcl9Gi404YpEJSuGyNfzn4AQcYYZVCPMPlqmtuqbxUg:iYkclGscSuGAfzn4pcvnCPAtuqbxUg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4032	msedge.exe
4032	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 3592	4032	msedge.exe	82
PID 4032 wrote to memory of 3592	4032	msedge.exe	82
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 5112	4032	msedge.exe	83
PID 4032 wrote to memory of 4700	4032	msedge.exe	84
PID 4032 wrote to memory of 4700	4032	msedge.exe	84
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85
PID 4032 wrote to memory of 452	4032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9d9107496036568e247ef3efae9b1da_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7d46f8,0x7ffd8d7d4708,0x7ffd8d7d4718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,2533244285353847539,15995808196036037736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 f0b9597776f91de921312d6f5c0d16ad6cc725cb4521b8458685f5c4c5bc35aa
MD5 230b1bc5cf19d31132405981532fea40
SHA1 cddda0e9b085be70830c7f422e5c7387e0c9e550
SHA512 3d6dd7773b582ad54ec45c8066e03e2fde11b0a746d1ca0ea2ebf4cdb7bf71c2eb124a8b7d957bf4718bc55f8ae3becb782b37d50257c67439fe0a6bde1e8354
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 8613a24cb0736322b1966581c36be869774b7e41917ade097ae7c80ce1f236d1
MD5 b58b82c7e92bf1de28f9a929775fa344
SHA1 fdcae24ef8eaf0f205625dde1066a4c4808f239c
SHA512 7886f736e4c76a3432b3906de9ecff422dabb35dd3aae406672dda53346c45a4f56fa0e9909e5408d7c77d9e5f0877d277638e7ac0a3f439c960e3a7e26fd8b3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d02ec9d45030269970a0c858096283452741855156f01b6fe207fd33c73cab23
MD5 5623f6bdd68404a788686bb0e24e6579
SHA1 4d00cff6908f4b341f7c5ba380ab9d80d0f8e10e
SHA512 f31bcc7b5082aad79aa8a2c4e51f8ab18de880bbdeac635bb20dbb7261273e8e9d1061774bf2edbb5010f996ef614aa7fb1f2c7a1986819085eba5aad767e001
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 86cc5741745011864220f824d0a1078c730edd229764acc4062ef1af11b8a6b6
MD5 c94216937cd205a20cdcea1c48dd37f6
SHA1 99c6429e84e1b5d7130639c07aed339cde2ed182
SHA512 01120bc4572a57cad17d775290dba60ab36a26bb31f98f8bb78c4581e982d021a4b0aa96a1480f9cf377cce8620a516c24c9e1f36134c6f96f7351f6879209b5
SSDEEP 96:nJAkR201R9wpvWMoiVmdeHm9BQUWQyV+VDCziEwb:nJAkRfX9GWMXFro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b7f858e6c6f464e2bd72d4188b3dcc36cfa8da477e46e34121bc78194cb6712a
MD5 1704f33d93f6e902e99a183dec190f9f
SHA1 427f5744993236ee303eecf8f41c4a47dc7484e6
SHA512 8458ff919b70b11cb8960dc5fe4384f185e99e2fa24e0c2caafab1653a1b4983e5cf0f90f9468560c21b17e9b40da5fb1bf877f3cd0dcc14337f9412532bae5c
SSDEEP 96:nJAkRD01RzwpvWMoiVmde6f0dop0IcEkY12melBQUWQyV+VD7AiEwb:nJAkRoXzGWMqf0dop0IcEkY12irg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 84fd87567b90613608c9a63ffa7b3561cdb1258c92b28e71b5ff065644e90086
MD5 61cde99b95475ee21944dda605438ed6
SHA1 e71a729ac26e9f7109a28e07f7178a2edfad656e
SHA512 d026a61050eedd2772f8a7aef81e364fc6e1eceae3cd6cf1e924e746e7b7c2389a35466a627531dd9aa70d76bfb463ae4d221ad49e00e7a52894d74e73583298
SSDEEP 96:nJAkRo01RzwpvWMoiVmde6f0dop0IcEkY12m9BQUWQyV+VDCAiEwb:nJAkRJXzGWMqf0dop0IcEkY12FrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d6756e3499446d129847970be88910d85f4db02de1fada1ee60bc780da84b203
MD5 03bc6616a884651dec533389c7b86e59
SHA1 1571dcf7699abb899416eab715d6910687474bb7
SHA512 943deded4af9ed2229565807a049cd7187dcb70741aff8bc7b11286e06ab87f9695bda1b7951ee18f759d63aa14bf02f81c980bd11df1184b47a18fe74cdd7ad
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1e2RUClYOXIcM/bo5Zxn:A9iIxuERzA83h09RZxYx3oqZxn
MD5 SHA1 SHA512 SSDEEP

Submit Download