706764354220ab6fe0657f2d0c2650d8fc48f6ca2ccca911fa4f258bd06c2808

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ddc06620e29d9a7302708443d1a7bec_JaffaCakes118.html
Size 213KB
Sample241007-rg6eqsyfll
SHA256 706764354220ab6fe0657f2d0c2650d8fc48f6ca2ccca911fa4f258bd06c2808
MD5 1ddc06620e29d9a7302708443d1a7bec
SHA1 ab33f440c457cce5cd22c9300cd59374f9b9a2fe
SHA512 558d444b6f0731060cb4c92c2270bed16cc89746eb1d398593d485681de3ccde0d3c23feaecdc933dd2bbf66d096a15ef2a5ab57a26cf7a74e66a2bd8fcc43bf
SSDEEP 3072:0IUkSw1iRYmRB7asDpUDvfDe9DnKDSaDZ9k1MY3kBD9biUacDKQwLK/K9odThhPS:0IUrw1477j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4468	msedge.exe
4468	msedge.exe
2428	identity_helper.exe
2428	identity_helper.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 856	4468	msedge.exe	82
PID 4468 wrote to memory of 856	4468	msedge.exe	82
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 3808	4468	msedge.exe	83
PID 4468 wrote to memory of 4588	4468	msedge.exe	84
PID 4468 wrote to memory of 4588	4468	msedge.exe	84
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85
PID 4468 wrote to memory of 324	4468	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ddc06620e29d9a7302708443d1a7bec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6b9e46f8,0x7ffb6b9e4708,0x7ffb6b9e4718
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1560 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9376227788636196911,11737358726495337885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 8684e574605baed23c645bdeed7144c6a2210952691988521821f985aabc6cd9
MD5 cc9056f5af2d447a5fdf0cd899a3a7b8
SHA1 5f567f06d50724cc58b52640ce332766bd37a26f
SHA512 8dafa84dbd00f72eedbfa9aaea2aac145565bf80700ec6bf8b1398ac3f3c866c8911d3ca85862c4d8deb64a90e5910c29021930e8a08d5ec3619dd6e22ea876e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1833f8d01271d60f4fae63b0bf78d5d6254065e41aa2b6f4164ce77bdec042cf
MD5 a2efc8017428225c4c0be74d5eec569b
SHA1 5c7c010eb22f8a34843e68569ba63c4e8d9f81dd
SHA512 ea1eb3ebc88fc021a39b3275db3729c63fd17cc891aad15e55656174be25162342be1e48414584abe06c74670706c578da21654d228a656ecb3bf6db1d60721b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 be968c510296294350093ed571cb2c1a7b3a8ebc57fa19b2986e838c12c31b11
MD5 35336cb18deeb3904d53bfc2cd9c8c10
SHA1 0cc3f542ac0259d73731223b8aa9f57ac460d94a
SHA512 e69288c97c82f8b9caef0ad37654b2008162a940f75df1e87278608d78facf1a045fd868ed043f3f5b64b6f06b7fde61f29f6e7923084461a41410dad5854291
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 52dc02871341561c737251a905390e9926974815a2fa4e5c546e31d339772924
MD5 86c2b4a4290f4e0ef319e72a12bfd785
SHA1 d6240ea1d6c6137abc41d637cb43248dfea247e8
SHA512 a7e788056f93dd4317dc0f97a7e4fdafe6a8fd9c5d33014b67e3439931697cdb18d97423292b597e80762912ddf614848c7b0e22b388549bbbd194c5f4623fd9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 2319a2c59ed3ca9ae2a49426659f16cafb4ac3fdcd50bb5d88429dd5af2a509e
MD5 1ee3545b3d5150a26265af56e4684d9a
SHA1 33bbe4bba524d946cdf66b217cf814af4fe41ad3
SHA512 ed5f2dc8c949d2e54596fdf8167995cb791fefa91af47d7b5f69f1144dabddffd4b63303c8e2eaac8666fb1f322667655581ed76e80e5d8dd4f4fdc04cee2c13
SSDEEP 192:nRAk4xVwGWMjWD5TNHdDnQ++7myqwAmQaMfj2V+rV:nRARxVNWSkY6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f05eb4bf679e6c1887020491333b5fbb70c90bef9e546463c35dbcc15f9475e1
MD5 7ecf9d0620b315143b03fce7d1389197
SHA1 2fc1859cb1faa2813cccda36ea828492f9ef989f
SHA512 2cb99db9147a70da7fdc625e8542d7a881b935eb10b98340a028a02ef02fb3db1347e557ffbab9f257b15b28e49f936fa5df6496c3a75443741137717e0ec4a8
SSDEEP 192:nRAkxx9wGWMjWD5kTNHdDnQ++37myqwAmQaMVXfj2V+rg:nRAWx9NWSfOP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9bbd15748e9047b42d2631cc5d2ab5239824563d8b249f9a76dc95291473efce
MD5 40723b7eea54daadac52305ac61e5b5e
SHA1 43b9939b3a4ddb8e52d7e33a34de9d0d470e548c
SHA512 f08d49ec3a62ab40b83137ced826edf87798a420563b574408b7b69b870cc4128d61c62b60fa76f67957bce579b38b701ac9164e76b4671cefad72dcb37fb48f
SSDEEP 96:nRAkZJ1zVwwpvWMoiVmdeH7CkT+UWQyV+VDCziEwb:nRAkzxVwGWMXV+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 a9e95bb8c87cc9c796f5c367fbe9e865babc8542575e41e479d814ae90554623
MD5 d4815250d6dfdb50f6306f655a3c2020
SHA1 b4f91746db591737eb3b2167b9bae5be3d533de3
SHA512 6b94d40e73d0c06b90510e0f1e7526d54829ceb33aa7f3779fbbf1981e870224e9d7599a4c7651d30cddc48b34dcd18569b17cc82e22af572c33d49f9fbb512d
SSDEEP 192:nRAk4x9wGWMjWD5TNHdDnQ++37myqwAmQaMfj2V+rV:nRARx9NWSsY6
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 5fd81dca3be0c67dbc98866fcf77ad660cd949be56e6c6a1aff50881c296eb78
MD5 96aaf805f0d9daaf1c154ea2b32096ad
SHA1 7d1afd96596075841a9206f69c5b3a403004a7ea
SHA512 62099da2f26d63fd02997f9517f9d11696288c00a3186b8f81b5cd28cd5a37986dcb07935a776de9fae6af73d8b56f2d268889f1fca23f4ae4fac7403cbe9209
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5814cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5814cb.TMP
Size 538B
SHA256 eb159abb7a4bdbbfc22e0db5447ec48123ee51334062838342ea9ab6c3413619
MD5 2e11a66da8793fb643457885398da566
SHA1 42b72212055e71f34949da2dca54024919554265
SHA512 b386ca9ccc0d896ee35559626b169dbca55953771db687710551d673c89342baaf4b91c4fb503cb1fc4b36871f306ab786296a7fb98801bd8a6747563745b530
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e88fe20214936bedfd59be2a34dfa635d4cc186b0e2d0bb0f5b744e001131288
MD5 1255083254d0822e51c9838c5533a08d
SHA1 1f5e47228a8fd950e3ad9de5ad74d23bf34ac307
SHA512 545103e2a7021d72554e72716bf22858fe340207d00fac93b5dcac7a070d3841e6d00efc3e6b5c01c96e0aeb7067427427e1316289a3681ed4e0ec7e13aa5f88
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupI5re2RUS4nDy6+B1E2Q1u:A9iIxuERzA83h09RZxYI576SbEz1u
MD5 SHA1 SHA512 SSDEEP

Submit Download