24e0f0ae1762f79a914f1f9b27ebef9f6f788cdc54048b3a5641be101bbd2707

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d4ac8a02294c5061eb9f08a9a8e936e_JaffaCakes118.html
Size 283KB
Sample241007-n1lmwsxeqc
SHA256 24e0f0ae1762f79a914f1f9b27ebef9f6f788cdc54048b3a5641be101bbd2707
MD5 1d4ac8a02294c5061eb9f08a9a8e936e
SHA1 c88b932d8448c374fb96501af834e113ceea9ce5
SHA512 0ca994f0b9a33c050d066e6deeefaa5b824b2723d27b3ce5ed9e50882a2be8db295a1c7182ed49c6ff965527b75e3c834086a81328846fdfed9456505d6154dd
SSDEEP 3072:O+W6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGggH3VY7RJvfy3df8G+:0DAXmNR8/dQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
1212	msedge.exe
1212	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
3764	identity_helper.exe
3764	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3592	1212	msedge.exe	81
PID 1212 wrote to memory of 3592	1212	msedge.exe	81
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3084	1212	msedge.exe	82
PID 1212 wrote to memory of 3092	1212	msedge.exe	83
PID 1212 wrote to memory of 3092	1212	msedge.exe	83
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84
PID 1212 wrote to memory of 2756	1212	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1d4ac8a02294c5061eb9f08a9a8e936e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf1746f8,0x7ffdcf174708,0x7ffdcf174718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11101896675336655148,13761254441019708897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 23KB
SHA256 83c4e32b4545e45bd3e673698c9c905a7f9ce02ac5c08642e5ccdf2624c7a35a
MD5 ba16446d3d17a4f4aa3c0880fc626139
SHA1 dc8508bb58c7fd75a075be5b1948f482691d25c0
SHA512 4f9025d959fe3dfb874baa5765d9b46d8b042b6772a4f79e5d56ba4226b872fbca5eeb60ab93c3c247445e879194cd787de7eeb4cef8654ba0452a8601e05711
SSDEEP 384:tU+gw6ZANCOehcIFLQp1N7sYfDUPbBGbouF/Ufk+/mc6522rk1l+vTZp4UMIomj/:tUW6qNBeaIRQjfDDbouF/Uf+c6kh1l+D
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 3bd1ef74d5321a39aa9b56e4dbb26466a6e471d29148db5d56cbdf08f6b13e7c
MD5 9ea8d75bb224b71a8a30497071b4893f
SHA1 938f9dc0b2047ffdcf702f212fdfecb9392eea82
SHA512 d8656d59af26dfca17b48ba55c474a600a5ac507dc2101f59900695c321a8eeabb8411b6afc308715d4abb14df9154886dbcd98b9165c57c605547eba210d048
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 69936fdccc31a077c6cfcafcd5b83ad963fe149d1a45edde1b021073ef808954
MD5 e4da586a1e59f01cdf217e5417ba6353
SHA1 fa8cfa1ce2917331763f2c7d4268b2a9aa5d46c6
SHA512 fef74d6b1ca3f74c9ce11989e06e1469b65046cd62e167072cb353960bc2d5f0553ca9a62995b072f4ba8d8c27f6555f3c931e990e47124ded087a10f34df4d0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 267e0e7f1ea20444ca32d9b18a8ff82a1bad0b0e7e058a6d14c060e0fb51f627
MD5 68c92c36a24dc8c4981c7d74548d934b
SHA1 bfd8a712b85483244cab1dfba98afe3cec275f7c
SHA512 a10685351ed746420bf1fa8b0527878cc383507fac1b59980683a30505d5b04bc5bb31ce9f4e2f87d7bc9fc3f76c061683318b67bb220946c7d1713b3cffd2b0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 15039961bc3f353bd68b3501a4a544300af5bc23f9c316b2f4d480e6db63b39f
MD5 71ac30bc92bbfeaf3436d1b2216a507b
SHA1 788ecb13ba80758060e41ec8b11e390f086ae559
SHA512 3aec5dbd72a2efbc29689bc048eb23b6c6a4dea9bdabd3a60f1457345408bd52d51bb4191af00b7f392c8b4059d60e084e6d3ff1f77ec46318cfd9ddf982fd81
SSDEEP 96:nAkV11MtaSwpvWMoiVmdeHBjsJXqUWQyV+VDCziEwb:nAkLWtBGWMXBGXqro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 a7dc293b3be35e912101aeab200a5aabaf3cef347776cfbc29f1a59d1c17459e
MD5 da47cf2bb46b9282a4d7b5d9104b3051
SHA1 bcb0b9f9b5ae261803617d9478e99051277acd79
SHA512 7697a151d0775f811bc2c5918aae149a9e38e0ccabee4af46621e2412e86b6b1dfade7724fd1ad0a7e2890db4777c5951443aa83e7fb0d33a9d633afa6354dc4
SSDEEP 192:nAkoWt3GWMubYegofgcMiSRRpS6ErrXZB2B3XqrV:nA1aWWhHy9MrMX+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d35598380c47643b5a7ab7d9222f6b680601b6a7ce8bd1d1cbca4f1c6a086d4
MD5 a24fec9bfe790069b709580634bb0444
SHA1 da6309aace1b5b7a158c1b83759b8cdb9af3b5b8
SHA512 275e5b84f0919ff87576b3c51d8945cbb0b4b6ec8828fdfa8b5d73c6968af4b777fd392a0a6d8acac81b782dfa30de38022082752556094352124444455d96fa
SSDEEP 96:nAkw11MtaSwpvWMoiVmdeeegofg2RX8GPqBjsJXqUWQyV+VDCAiEwb:nAkoWtBGWMuegofg2RXZqBGXqrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 71b239694ed44f0467e80297d0822eb1f20f33f02f9ab86d0ca594c796b48130
MD5 b560cf8aa240aa9aef67a006f847fd3f
SHA1 18a13014efbb6dc705302d56340bee91d0e91750
SHA512 d9e996e9827b8abc1a93fde95206d62bbe97f20c25bdda89f8e2d3b90b80ae80d1bd29b95e4c2b645115ddb243cb84d3d04a01e7654de4255606e879fa4972ed
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 dcfbf618d8173e55bdcf74895ed26e0165037954548f2dafe2b5e749cf150455
MD5 cc8ab54b8b5eea0501740240284891cd
SHA1 66d41a2d21770ecf19a779af696acccdf7219089
SHA512 b1d7debedcc478e95416674134d010fd522e52eefe0ddc4cd34ec6462e39f7e7fc87fb8d3b7c0c04e9eb05b09fee02bc0543b93183d99a97cf66aaa7b0962f17
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 b4da01a53629390d72827ec5dea43e0e7ae69d23ca68ebe0f463ae681e68727f
MD5 5118d7dd19946d74d5137a061961f2a9
SHA1 ed75687b8cefc683bbec5c8c920b4985cb638c8a
SHA512 7ffe3661ca605b6addca954805bfb0c95c4680a347bdfa84fa3302f6e4be8cb13d62f450fa8b68556624492bfcf959cb7224deaf94344fd5f019d27bc25e19aa
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fb77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fb77.TMP
Size 203B
SHA256 933cd1a178788e485ee5dcc9076dfe5252ed5f6de669c400f5da826f6c41b16c
MD5 85e95bce2911382cb731b16d79a1277a
SHA1 8870ed507b98cac414bdae2867952cb611424857
SHA512 5ec02b05bce6331619c2c2041c0759a099bc0e50b1a0e171d5477a484dbc06943bfffafa16e2ecf0a904cb46d04687b351e2e2c79ea74a78acb3336089b306f7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 dfd051975042b2ee106310f9ab94ca92d613ca59bbd9b4c10515de48496f3451
MD5 756aec473adbd19a491cb5775e1a1b64
SHA1 fe64ef1b47a3644f4ba4733adaeb24fb7eac08dd
SHA512 25d00112d665f5f03359aa4d9a56887a66ec0deb1fd73af873466869fe4fd4e54809bcd75a6483aba5332760ae80914438de12eb663d8772f894295d5ef7e279
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcoe2RUf/chlvuidy09yKu:A9iIxuERzA83h09RZxYhtlu0YKu
MD5 SHA1 SHA512 SSDEEP

Submit Download