99aad602e4f87a16304bafba3d936679b2cab03e01296f21b8aef3c1811297f4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 18:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
438e3ccb9dd9404162901824130b8572_JaffaCakes118.html
Size 199KB
Sample241014-wxthbsyglf
SHA256 99aad602e4f87a16304bafba3d936679b2cab03e01296f21b8aef3c1811297f4
MD5 438e3ccb9dd9404162901824130b8572
SHA1 3e72474796535513bf876dfa72bc09f2b66f3c2d
SHA512 262702482ca2af03a2aae425ea4422becbd0f47f637057460301858d37a16650f03384a7d820777f2947b8cdb41c4d6bf69cdee6cf407b1e7785299933c1f74d
SSDEEP 3072:LdtqlgjUa9sB/nCXAOw+R67S8LR3fwa1hWuykxlP7eLQv:aAUamB/nCfgv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
4324	msedge.exe
4324	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1576	4324	msedge.exe	84
PID 4324 wrote to memory of 1576	4324	msedge.exe	84
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 440	4324	msedge.exe	86
PID 4324 wrote to memory of 440	4324	msedge.exe	86
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\438e3ccb9dd9404162901824130b8572_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb29d246f8,0x7ffb29d24708,0x7ffb29d24718
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

f_00002f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f
Size 23KB
SHA256 c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e
MD5 8b41d9e82bfaf51825f94b0bc9facf25
SHA1 9f988a1b5c14425843d77bccca491b419f115816
SHA512 9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011
SSDEEP 384:VUOgw6ZANCOehcIFLQp2ZYy6V0Ygln90MqOFCTvhAhFn4/i5FJjW7aGsuDCtx3hn:VUm6qNBeaIRQor7lnyFqCzf/iiH2xxko
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
Size 45KB
SHA256 c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051
MD5 ede70f717200a59b4cb831635de913a1
SHA1 d4d6e893ac192b5df087e924ab3356852f8a7bc0
SHA512 b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672
SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVGUF/swJ6olJezvFZ7jQVgoGuGQEPaa1A6X48r:9X/q7uQFcGes06OJQ8Vg5QEa+zXHr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 b1ece635af0d10b2ddc512d50a81a8e0bc2c9adf1e11c632405467abe96dbdeb
MD5 4f66e9dd69b4237d6691ef0c017865b5
SHA1 464c5b9148b9691385766fff81906ebf909aa4a8
SHA512 009bf2009e90b22cb56f60945c5523cff63d56cd81b775a3b46f17a72e983ba112dfa33210172390b946f9d5a5402a1ce78b5efd94a90a4e20b4677507edcb42
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 fb21e200594e117b07bc80c3f73bdff16e6c4f6ff9d37bf48eea4800df3f381f
MD5 ddb8f9510d46850458f6823f69932bd5
SHA1 593b5f3973063bec3eb365c59c3e6ba4ca675238
SHA512 4af7d30a3aaf79f28a3a675b5cdbf8100b2118e3b4be40c16a096d2518918cef0ba32ad8dc489e8d2c0f9381a068a9bfb4e6121c51d39e0be467a06e684f113a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 8fae24dc48f8d39f6b40992077f83b9a20abbdfed2dc157fc7929b6ecc488c32
MD5 2c211340d1dd63d4965a7261c0833089
SHA1 4a5df58e543a68fa57ce801f32d5d6724df69910
SHA512 5ca95606b3f4ff39ef5b7e40788fca7906b4263c5fb7fac711f984c7655ae05124c22935cf7ecffdd8b1dcc295db0fc45486ba653fa87478a18f9d3eb854980c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f639a739756e74cbce1075a07d99119a5c7c69237e32f18409db5793dfa4d556
MD5 6bfba7d9cf4a8d9c816ddd08aff652c4
SHA1 5a0f5459f22a6962c4bfb1b0b747cf8d549359c0
SHA512 35334d431cdd13526910d7be8fd7814c466e37aec7a2606825c2ca701022ae2115676d7b4d959bcff25aa8562b6cee56513cc7f7c5a1dd52a1b1903945322a59
SSDEEP 192:nEAkx/Xs9UGWMSZeFwDGSGjzNwMeEf32hrV:nEAOsPWcDG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 d1dbf4dcb7da917d9800e588ddf10431b2d7e04be2d07d3d8501a66e259ff8b8
MD5 277ceaf3cb9e9dac2f1eb3d573dc4383
SHA1 dfe2d0f6d5508cd658cc5ff7a97463950f4b8861
SHA512 52fcbbf27530c49f30f3715be8655602e8a7efbe8150d71c2476ec59d0c66728a2368187a346e9b5ba3fccb0b69bcab53fa4d53e14bee2fa393b4427508932a2
SSDEEP 192:nEAkxjX49UGWMSZeFwDGSGjzNwRMVeeEf32Hrg:nEAu4PWcUJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7a4c6d50eda8ebcb48b94fa94dcd4ac3f6f648bd0c55baad5f735a3cb8f6ca86
MD5 c9f8378464353e8caee03087cedd37ef
SHA1 ea15ee27ab5a8d68668c73344198637379fcd1bf
SHA512 0c327e122c8f8ef460dc687131ae6b3d81524dc8b272920dad85226c5a9e1362cd97d83a7bfac9d5389e56383d6cf12b6abb7e506e6a1acd97f02eda59762e12
SSDEEP 96:nEAkAxm/BQYmqE1OYPfkwpvWMoiVmdeHycJUWQyV+VDCziEwb:nEAkxKXsYUGWMXhro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 571ebefb1690a6d7765bfec4539950f9a830daa63db350040b8c5ba1cdc25a93
MD5 6c74e3a4274e3d9576f1cfcd4d83f103
SHA1 d2874e326b1aca012a27cab3d64b21e4d3782c7b
SHA512 58262643a00048e411226f29aa1da4afada80a6a39c22600523d5960f3b8390a272f7530c2fce431d6e2107b5e6493cbe23891f33f2b771688e91b13147d1cef
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKle2RUKpdz76+B1EHGDu:A9iIxuERzA83h09RZxYKB3RbEmDu
MD5 SHA1 SHA512 SSDEEP

Submit Download