ac9d868c13b785fb611dfd76cb3297aa952e2c8236a4f50ea273e77211dbfb19

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22b34e9031a19c2043312b3b825e374c_JaffaCakes118.html
Size 123KB
Sample241008-vpxpcaweqj
SHA256 ac9d868c13b785fb611dfd76cb3297aa952e2c8236a4f50ea273e77211dbfb19
MD5 22b34e9031a19c2043312b3b825e374c
SHA1 b51294765fb8fd7cfc35836e3f42badebb2d3e50
SHA512 b52585c9b25e964c4a8bbacc7b96a65c80a19f315e2d496b63746bb2cef4b26ef13780975f1c6d7a6a92ae44f93b0108bf21c6c42f194c4987e5587a6bc68bf0
SSDEEP 1536:c6Ob+xV1a79kF/ar8pr7ermbeUrJ00PVCnTpeHSFRcyOe2l9xTndcqCm1uvlYdq5:c6OSxba79ubTyOe2l9Rnuqpuvlv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
1584	msedge.exe
1584	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 4816	1584	msedge.exe	83
PID 1584 wrote to memory of 4816	1584	msedge.exe	83
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 1896	1584	msedge.exe	84
PID 1584 wrote to memory of 5000	1584	msedge.exe	85
PID 1584 wrote to memory of 5000	1584	msedge.exe	85
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86
PID 1584 wrote to memory of 2372	1584	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\22b34e9031a19c2043312b3b825e374c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb993b46f8,0x7ffb993b4708,0x7ffb993b4718
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,8523701076267175798,12706837541780801583,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
MD5 8749e21d9d0a17dac32d5aa2027f7a75
SHA1 a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA512 c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
MD5 34d2c4f40f47672ecdf6f66fea242f4a
SHA1 4bcad62542aeb44cae38a907d8b5a8604115ada2
SHA512 50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
MD5 SHA1 SHA512

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 23KB
SHA256 65edc4727e2bdb04a0ad28564af17bcf3bd7029811429804d283c8f0e186ce09
MD5 c6ee151c95d5bd2339c67eca774449fe
SHA1 c2de7e4a87b91ddd246fee53b8274b35fc55603a
SHA512 eb04604f00aba42cffeecf266cc7dbfc096708ebe615ed2141bd422585db26a12b54f9c22041c798cb01e4c3d3e5c70fff935b0c7a508fbf61f6201c3dc678b8
SSDEEP 384:VUOgw6ZANCOehcIFLQp2ZYy6V0Ygln90MqOFCTvhAhFn4/i5FJjW7aGsuDCtx3h2:VUm6qNBeaIRQor7lnyFqCzf/iiH2xxi5
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Size 45KB
SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
MD5 ede70f717200a59b4cb831635de913a1
SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 03bcfc6ea1103c0290857c6c14f7ba7c9717399aec48514bc931b688bb31762d
MD5 167b5bf1c4179c1bdcff3e1e88c7d03b
SHA1 1530eba830029855bc83b4d1931e6bfa62db9913
SHA512 954cc128515cabcff29680861926f8710dd43a760a178be7cc49b331bf8a65f9a6cd02f05ff6369e0275945bdf41460eadd9da3c0c8276f048e897a00fcb5b91
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b17e43231ba676f0b3bbb1a77a13de7a25f030b0c8369effa22e13cdcedbb28a
MD5 3d8916350baf88a96a84b16d85d66720
SHA1 577550bce200cae5d0e2d110f919ed84be696af2
SHA512 ed8c43f048988cdef3b367d8b2b94de53a5b6236788feba495c0065b4a582fbe2c13afe1f379ec31e4b1746fa591e358bb8461537dcf61cb2672678f9ae972ac
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 54a426ac5e9939f9677142dd6e3219e6b7b1d8a91fc1eb3043f59c360a282418
MD5 3f72ef6fffb9b360143f2c1c0523091e
SHA1 23fa6b560bbaaa3169c87ea95f979c56ec0a6844
SHA512 ee9b0c5c77d62eb32db477b64fca08949452914896d6949667d360a8e284cad08ba605a57f6dd93dbe96a863b02cb1688d43730ca03f6e19062033c47a77d665
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dc0f47701932f027219f73daa73467c90998dc6ca9dc0ac6239169641b97a533
MD5 ac88162253abd66fd8f2db1313b70a7d
SHA1 91ceaabb7039b51aaa9233b26aabcd80893db7b0
SHA512 2682562eccd36c87116d6d4ad9d4f08ae3b1eb927983d0483b2b6c53bf10d0caa0e8f551bbc8de096e0810ec6360ecf5ed057ead01b676fe73a1924c9562b36b
SSDEEP 96:n2kvP1RbwpvWMoiVmdeHhOMztUWQyV+VDCziEwb:n2k3PbGWMXcoro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 82a0e9d37b68dbea6bb05f4a9fabd68ad3c802c992660aacfc9e27a65627e520
MD5 4d01c6cfc95c7c654d583ba7829077d7
SHA1 936adbb030f22c341b3ce052bd980a376bbe79fa
SHA512 24f62503113c6e5ab623a6e4195713b0c359309defabd8b65b272369d166c42999968e50fa23f912a738de94fe1b260432c44923b69861d626c2f591e7f53801
SSDEEP 96:n2kuP1RDwpvWMoiVmdeJekN/z51QSUExn2hOMztUWQyV+VDCAiEwb:n2k0PDGWM5eK/z51QSUExn2corV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4d84ba74fba518bbb49e05309cdbc9f5e718f713a59f0f62ecbe68215b80c208
MD5 093a1ad7b4a3052334f4f15889719887
SHA1 a73f103373358b64abd7ea329cccc2eda78d0b74
SHA512 235e5a7d730c2a42b6ba7d110b5f569528dc306595f3370215614995eb95e7f91f3c8edc3863fe73a3a7f8cc5ea95fbdf236adf6f2c33ad7e9e47152cf99fe8e
SSDEEP 96:n2kuP1RDwpvWMoiVmdeJekN/z51QSUrlAExn2hO4ztUWQyV+VD7AiEwb:n2k0PDGWM5eK/z51QSUrlAExn2c0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8242aa2199e54ca9c80674a0bdf0ef0e356fe30fddb5403ed815b39bae85af16
MD5 1ac3c3d53ebc5077204470cd9e07a8a7
SHA1 d2be7b7e3fb5d4dd62bb244d2317dbf811756330
SHA512 2a778a8bb17481fcae5a1b20a6c67f0e88db46129501e8ab435866036b2bca2ae1ecbf426481551b922a8cd9900b39fe2883cd2e93549a2438c3dd15a56d6e54
SSDEEP 96:n2kuP1RbwpvWMoiVmdeJekN/z5QSUExn2hOMztUWQyV+VDCAiEwb:n2k0PbGWM5eK/z5QSUExn2corV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7ad36ecd5a393785ad918eefbac6c50ba554e67ad1058af28177eb6422993f97
MD5 8a718054dcae1d40a437163e18c1e957
SHA1 37594b5d51b18ba83ae53876fb0bf11b7850b88e
SHA512 360e954fb44cec69006bdd56735b53f79a2fcd54880cb3136adab4f1fee5d4136e51e20e1367bbb545ce7c6be0e4aeb535d80bea4f4de2b9624cbbc203753cb4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupv86e2RUqIsl6+B1ECQIu:A9iIxuERzA83h09RZxYvzFXbEvIu
MD5 SHA1 SHA512 SSDEEP

Submit Download