b3dca23b57cb5d8ea3e8140f143ce7f890cdea2e36a1a88b39a0d01cc2567e06

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
043455b5cb63c11000c1957bb10f949e_JaffaCakes118.html
Size 170KB
Sample241001-d1cd4ssdqf
SHA256 b3dca23b57cb5d8ea3e8140f143ce7f890cdea2e36a1a88b39a0d01cc2567e06
MD5 043455b5cb63c11000c1957bb10f949e
SHA1 0d4534a25fb667c3c475a7be48767dfadea138e5
SHA512 75159b214f2c49a56fa04ea83217a509023065814416d1107d9b249bc35b1e88b29d5cd23e7627ccc0d68cb6923f268eb2d6e295c4e75d3db511d521007ff768
SSDEEP 3072:gDJatD5IWmhBVcSX15+ZY2Xlp+2eQexv3YjWWBMIBo0UnfFhOoIVypv4ylskbz2:gDJag1s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2632	msedge.exe
2632	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4548	2632	msedge.exe	83
PID 2632 wrote to memory of 4548	2632	msedge.exe	83
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 1964	2632	msedge.exe	84
PID 2632 wrote to memory of 2748	2632	msedge.exe	85
PID 2632 wrote to memory of 2748	2632	msedge.exe	85
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86
PID 2632 wrote to memory of 4884	2632	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\043455b5cb63c11000c1957bb10f949e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae52946f8,0x7ffae5294708,0x7ffae5294718
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2481746268049594404,448651268618879396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 26446dde409946a04602ff459c551642626bcf19d168c8c8725296b1ce1011e4
MD5 362a0b91615409350c824b5df3859651
SHA1 5e821de01893c51a6324b25c1c9a2d7a9c2526ab
SHA512 e450256f380cf8285beacd5653bcfdb7961ae9a535a14581ec5b175dad5dcb5f50cb5532a2113bf8054b012c02d27d6acaaf8c61c63e55964ffec630ff5bb2a4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 b9a8d77a824e84bfab9a3a5944e7d1340838ab4ee2f0649b331bba49cae49a72
MD5 6b1014d4ba22983c336af9981dd2a388
SHA1 88df1889dc775e347a4d91a92c044a3770c61cc8
SHA512 29e2a0fecd6ea8f0d19c061f20c41316341e062f3f683017dfcfdd6c3db97181facfc5fd61f21635c14a3ba17b1af302e7314f5030a0d073561b73d1818432c3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b3a9c3bc50c2464f1d4a4fea1432c3cb89928771b0d8f91dbd4ac9b40900980f
MD5 e8538daae2e934d45f170f5dbf61227b
SHA1 87531cc625f250cb1360d68a785a3068f28ace47
SHA512 414592f1a7b145dd53a03683dbd3616a7b7a24a0414146829983571f4c7c928d0af9ef68987b685e4f43e160e8978cbf79c5d9bb0ec89ebc4de1b76a2e75f2ee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b4f2e8c0d55c525943eb8b2522abdfa80ae07aa5dcbfb3751927e9315cfcab07
MD5 c1524132f904c51c3d423cdb3b10caea
SHA1 4204ae4baba8abf4af237858ce9a851370f2aba0
SHA512 3ecc69036d2a7c620e67eef92fa31140c2a8b30c85ff9e71e7cd89b576f2b53f4d5b985486cfe3cdf2b6d50207bf3470654f29505b5b6c7a32ad1eac78ee3ab9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8d2984d49796f48767e00dc1580d9187b7d3ce077ac02a626ee64b9e72875a4b
MD5 246f36a1efc98a35f062aed417bb709f
SHA1 6fa42c27946ce623da6dcd3d607ea173efa3fa85
SHA512 a64e7e21b5938442f9a78683e5677a519692537ba41b7208ae5bf411704d7293971a141eaf2786c926f0b31981c04e93484515d2327a0e0f909596dca879bde7
SSDEEP 96:nOkz291MTOrwpvWMoiVmdeH4s5/ZtUWQyV+VDCziEwb:nOkzqOOGWMXRtro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8b78cd2aa9e963355b9f0e38b6bc21e288e44475b41a4be74e1f00250d648090
MD5 2db8a0081639d73b73ab890732773217
SHA1 fbe3ad723a19cc8550a4b13af0d9146ef02711ad
SHA512 b1b16c7f29b9212d50e24a1edc70bda5f3e2ef34b3548dc68fe50761ef51d54b1f2f80f879db1df0ddc490cff0dc0a39504a64f2ce074cfa4b5481e9a30336f0
SSDEEP 96:nOkzA91MjOrwpvWMoiVmdeMfybjM2nLJV0tQ24s5/ZtUWQyV+VD7AiEwb:nOkz4O+GWM8fybjM2nLJV0S2Rtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d855149e54a8f13f04b420084345d81784e64033c12b1e8a2031c4a5fa05ceeb
MD5 da14b26db87dd40ddf0f36c4c21f9c17
SHA1 115c63f7f6679a21d470a8dcb210ea266fc5a15b
SHA512 48a4b9689662f5a1fe3f6fd8b4c88be4f6315dd165b77efc98ef080f80d2d58b062329351dfc904415bb7c5bd188f8a6c8da8eab6626ec8aacc2e2ed10ea2dce
SSDEEP 96:nOkzo91MjOrwpvWMoiVmdeMfybjM2nLJtQ24s5/ZtUWQyV+VDCAiEwb:nOkzwO+GWM8fybjM2nLJS2RtrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 edbe1603a22a1178248a51774d3b06e3368fe79bd590b6f4c4e64e4727e95c5e
MD5 0c14a745dee818b16aee5750429bb7df
SHA1 3a7311d748bb44fdb492ae26e196afbd42dce50a
SHA512 9aec8351496f6b3a84e1ba6f8a256a2020049e7a169c7489db375010df2f810910faa2796fab48ef2b70cd1b071c880e834fdc836279ac6e5b50b88fd58942d5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLe2RUVi6DIcM/bo5ZxD:A9iIxuERzA83h09RZxYbKEqZxD
MD5 SHA1 SHA512 SSDEEP

Submit Download