68bb011d87d77166bf93ebc229ddc98857fb80fb1babdc7254c1c5602970007c

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4fdba9df27d11770177c4f2c2ff15047_JaffaCakes118.html
Size 65KB
Sample241017-arhb8a1hqa
SHA256 68bb011d87d77166bf93ebc229ddc98857fb80fb1babdc7254c1c5602970007c
MD5 4fdba9df27d11770177c4f2c2ff15047
SHA1 48080d2596f9ff053e762d63f7ba0008e6266257
SHA512 ee6fb2b70c92ed3e154eb9de873074bd923af5fff75783fb6a8234bf08031291b220d454cbef8bdf30a904e86721bd7b0cfc06e49930dd7ed36f5ec633349c58
SSDEEP 1536:s7kl1ukruImnSlpBolQcaUAzt+Oms+yEbEnza8FztCzq:s7kqkqImWpBka1thmf9bEpFztCzq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4384	msedge.exe
4384	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 1076	4384	msedge.exe	84
PID 4384 wrote to memory of 1076	4384	msedge.exe	84
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 3284	4384	msedge.exe	85
PID 4384 wrote to memory of 4208	4384	msedge.exe	86
PID 4384 wrote to memory of 4208	4384	msedge.exe	86
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87
PID 4384 wrote to memory of 2416	4384	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4fdba9df27d11770177c4f2c2ff15047_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6cca46f8,0x7ffc6cca4708,0x7ffc6cca4718
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9546789509730504175,12695615314572431747,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 23KB
SHA256 fba866aea3cb0fce98cf10cb57975933d6cfaaed27f9f25250008814c9bf8e95
MD5 318ffbb8b70b421abc02996dcfe8afc3
SHA1 4240e64a8604fa36481bf24471545a2c7c10c89c
SHA512 1a0f6266836348c4ee0fbfdfdc9197b66add2a5b150ea8a1205b4e3876eb5c82d7404bd26791de29ff48004dfed187d9bab5a9678dfe1c71cf513dd49abacc56
SSDEEP 384:d9c1f8gZD1bt+03w6i9xuJHJSeH4gi8Bq6EVg+P/0mpq87d9+70GGb3llHlM8d:d2KmDx8uJHJSeJDBfOge/02J770A3ZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 42KB
SHA256 9b59525954d9da17ff56cac0c0cda55bb6c4df6b7550fe68565fe0d24a963ac7
MD5 101f2295c59a6c129b95bb68093aed06
SHA1 12f5843daaf99bdb874dfebaf10660c54ede2120
SHA512 f5e54b7609a1884253f1d05d9245def95b3721e1163ddabb6d32f5b31f824a218c60533eef25a6f91d8ae6fa314128ae258fdc341cf9a4f36bf378e874b5277f
SSDEEP 768:BxjJZM9YDBsMMPqV41xckRE2jiwZSGzvxQCkmamkEsyrdiggge/TZXm7xnSAD5Uo:HcYeMk/9+bOp8ZyrdigtkZXm7xnSANUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 2d733f6f61be97a9fd0400cbc47f3d899ad7cf37824355ec1616c8350c3fc81b
MD5 edbcdfcdddb464b32091d639bbdbd8ba
SHA1 28eaa68e6ed7e3f2e3a12c943208fbf7bc4796ed
SHA512 191cb914540582f750e33df952f14a35138f8719d5f779e67a861ccf07aa14620d8a2160ed1a067f8823d78e5ee102cbe489c4e2ceeef94fbe9ed13d99c7a17d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9af2200e0b29799a938fd6d8a7e204c152a9ec1889514f54026d0106eadc37d0
MD5 4bbd644751416b53566bfceb5db89250
SHA1 db8539b8008d5014d5b692501a866009f5bce9ca
SHA512 1c99cc25ceeebcfa193d92896f7d56c43c5007e4b5286dd86ce2bc186f51286b83867ac84c743cb8d9f026682d4cbff46b18be601fbebad95cd56bf9d3ef3f3f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 edfd6a9d0db4e995c5fd590e750c9feae1517b6cb9e11dfd8ed9d2be476b5f81
MD5 f48fc69bec3d9b88865641eef0d7fd68
SHA1 838f7bdc680b797efab64cc1230e2157d5b7ae66
SHA512 731d25a459aa23dd03c463c99b6c27659cc64e7be9c7e079b01d4cdce67e24848c602785c7be397f76b4802161305a571d63d612f4a59195a99bbd13063b217c
SSDEEP 96:nBk+J10xwwpvWMoiVmdeH7CkKv6UWQyV+VDCziEwb:nBkiKxwGWMXi6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9cbd3f917c6258b5472bcfd8b38c4b44f0a1ab908b3a264803a23e343d45f381
MD5 6a6b1f61363c287cff565055cf952f59
SHA1 9e4af8e9aee0e4bdc4edc7a77be4304dec4cb922
SHA512 945119cc88c94e32c03dda77a20eb82fcc006db2e3c0f7aa721dccb3a47228c1577a70deb8846344249125af81acf3fa0619170947737bacbac671481e36393a
SSDEEP 96:nBkwJ10xwwpvWMoiVmde29tSf27CkKv6UWQyV+VDCAiEwb:nBkkKxwGWMmvSf2i6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a89174353c91cee1dcc33011b1b6b401d9da1bade68b6ed47c590afad3f9b26b
MD5 9b0f753b132bef105a3f4a1a5232e6d4
SHA1 7001ea18d36dbce043f6c8548ee370b76d443784
SHA512 0d18d0c5eff4c5d68642b9140948ad6b2c13d7d41c8c40359e9dc71a92d8d2c632b9dab0d234c0031c5d5e696e1a6e6544bce5cbdfd1145f4326b3731fa09d90
SSDEEP 96:nBkyJ10GhwwpvWMoiVmdeMdv9tfF+fKA27CkKv6UWQyV+VD7AiEwb:nBkeKGhwGWM8dvvfF+fd2i6rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a79d8c4174f399a9493071c32a6202d51453f8a967f2aa43b4d81e0e6d0dd8d0
MD5 d4075201e35caaf0a4cd8188528611d0
SHA1 66edf61cc91bf366584a9b8b201fc4c12b1a3945
SHA512 b0df398bcef7dc6544190f03e2648da9d2b388aa162ec9a7625fafe507d228c005642cd535e412bad41df7d1e65c82aee047e1642e972d75c5902afb4b514634
SSDEEP 96:nBkwJ10GhwwpvWMoiVmdeMdv9tfF+fKA27CkKv6UWQyV+VDCAiEwb:nBkkKGhwGWM8dvvfF+fd2i6rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 ad10bcdb2905641ccdf04b7244c256689df5830401099d81775d1175448f2701
MD5 c0b594e52a5eb43fd5e2b65bc00891b6
SHA1 cd564578a30c453d5427460093d013ce6c537eb5
SHA512 90068f91a5978f17ec9f834cf2a4b740e4af54f58c9111a3bbbdd7cc95195f0a99289870e4cdedb5d354131f0bb1554a87cb63410a8a2c57c823187ff37500af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 874B
SHA256 9338f88918ddd1172c801f8b7cb6b9afbf92888fb925360439fddb7716a30440
MD5 a5b45a1d6ea9ab6f88065b27b9b73114
SHA1 1cb26f0b6430366a827ea3fd078bb30993b86dc4
SHA512 71cfbb8e911735559a762df758884bd7cf2f6081926d19c95388c872d721f39725c931d781d64486e5fe12f22d3a875aad180291d97c295947c5beb36dc5072a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ee09.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ee09.TMP
Size 539B
SHA256 a38153e3007ae0bb2fff4661b50e8e8b64a3bb63743efc5bdec656cd0227a80c
MD5 a67b10a07bd19b39885c0db2203b2e3b
SHA1 53b1336fd21513a87aaebd22d63cd463fd043d70
SHA512 ec75843d19b5a71214a860f3338bed8073818d78804676a064ea3fe382a8205161f13b1787ce1660cfe9c5d5609fd0632c3339bd95992d55794364dc60b74060
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7a120ba71f95fb19e0ac39f95b07991185ca9c00e4cf50a12f4ca6b200af94e5
MD5 ef461342eac4d0c1bf920fe765536048
SHA1 8f5cedfb01843044377c6d959b4ebf590d4116c3
SHA512 06752e6e7d9d418d98b45f73954169d143a8fa07b6683090b969905f2f8c931574ac2e9a0a1ced2b8cd5aba605afee56d5c1f29c598d7b85c4a657bab13c8488
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupVr5ve2RUd4nDZG6+B1EGSo:A9iIxuERzA83h09RZxYVr5XTYbE5Nu
MD5 SHA1 SHA512 SSDEEP

Submit Download