bc39a98c4eb6a49c78eed5161d3ecf71d21a1341d373bf5a1a352ebffa0af956

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2024, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6fff9a7e38124c433f0496c867eacf4e_JaffaCakes118.html
Size 229KB
Sample241023-vstf4a1fjc
SHA256 bc39a98c4eb6a49c78eed5161d3ecf71d21a1341d373bf5a1a352ebffa0af956
MD5 6fff9a7e38124c433f0496c867eacf4e
SHA1 064e28390b046c30d19f31fa358ac128595b6966
SHA512 6b38ed911295f9fb0271dad4f0e0be6d0b91502b72865a4c6504f7dce71d56a988964a541ebcba958e6a5b7e0f422f4f221398fbe57e0670a0c58d56681954d7
SSDEEP 3072:huzrxsGCHgIL1g1snHlgbmG36hC0uYqE2fJ6MZkPuKbr:huzrqGCHgIL1g1Slgbm7hGA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
3076	msedge.exe
3076	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4480	3076	msedge.exe	84
PID 3076 wrote to memory of 4480	3076	msedge.exe	84
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 1736	3076	msedge.exe	85
PID 3076 wrote to memory of 2076	3076	msedge.exe	86
PID 3076 wrote to memory of 2076	3076	msedge.exe	86
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87
PID 3076 wrote to memory of 1928	3076	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\6fff9a7e38124c433f0496c867eacf4e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd317946f8,0x7ffd31794708,0x7ffd31794718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4052665672234683870,15194212897085878764,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

f_000043

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043
Size 20KB
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead
SSDEEP 384:wPSxXxKeJEsjg9wbw1t33eVliNGb3naaE0QmTtcOJv4FYUdrAd1bzxvp:BxjJZM9YYOVliNGbXrQ83ODABdvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c1966f20feea4697ac218a7f8afa26bbe1109b42b007ba353052b543da55f40a
MD5 f420f6e6a10940bd4347414701663e0a
SHA1 91659cc8587392e08c29644566f3b527fc22f492
SHA512 6858b42e3bb6d9f2ac85748e45a40a1489a6990c27cf270906d397ba3511a95ed7bd5b595e311a1690b11b88be058778268a19b516691810b35a430614bf508a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 8de7bb82ad88794fc73aeb997769ad0c1807470c501790b8c7b9c57d366de338
MD5 25d693f34fdbe81f18a87675498a69c3
SHA1 2b2cf1ca5301eb3a8a30f24946320276f691aee9
SHA512 4823e8764d27ed8e1af14f5f9773d6f33819644923aa25554d2b598c6b397ac84728a2e7e99e01b3ee9c4063b0f5695dd009dac7f5ea616f6748de14f3d88643
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 8cb0c75c86ec385a8badfc2662dde54aad25c4c0a42fc79a97e988408888d7a6
MD5 24e36211b7bdaa7206b059c0f1c9461f
SHA1 a3977905748caf7b3fffa54a710266b59698d755
SHA512 ff3b8c822c56a05543775c692136b0a8f846ecc1b52a5a0fa78d5b16fed8610849d58c0a4f4e54ca0732684f85cc8af9b7049cdc26d83e53d1f0d526d477a8e8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 ffba51bd82cdca3fa54af3047a7a25ac657b519e9af936ecd60653973cc40c05
MD5 f1b36b4bc318ade5b7cf16a9e263d984
SHA1 8c448ab5277f86ce4cf4b68ac53d437327abf91c
SHA512 5a557fb1d89917f5b2a52d9fd8415e8212f4244e671b8c92d7f3d7a2ae8091769b955dcdf45b0b63ba74b43b133c3b1af6d457c9e0b2a9adebc8f9cf99c32fe5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 71234422c954a19b9674d99a09fc9ca0bc6dd764ef3086d6f356c062ff38e494
MD5 d0a127880d1192d950a07b68da4b10c0
SHA1 a5f12b149a671fae3d448ac8b984fd5ca3250071
SHA512 a3bd8452ce3b53be74305c9808dd3bb0dd463e435c756d2d13b3dbc227fe6648c686ea40318e0de9022a11b6db472d90ed356ee1fefd29bf44836166bdc28889
SSDEEP 96:nfkcy1W+WSwpvWMoiVmdevTmNSUkq2Bjs1UWQyV+VDCAiEwb:nfkn8+dGWM/TmNSUkq2BYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b9eb5508f85832728503ba143e50f3f80f1bbf498b0aede2d90ec76ea0df2894
MD5 311cc6ef43cdd5f8a893d3c094e10cde
SHA1 94a457022233923d5df07821a3e79a4c42aa997f
SHA512 6cbb9200a3336c2fce23baee047e73a167ee071743790f74b6acf4be3b87233e7bff330154efc684ef1faa73ebba40199e541a6beaaf80d9b4ba52c5fad8f441
SSDEEP 96:nfkSy1W+WSwpvWMoiVmdeHBjs1UWQyV+VDCziEwb:nfkt8+dGWMXBYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 84556a5245658d601b9b1d6a592e75c11003b60db6421c51ec561c889de65697
MD5 c4166b79e5010858b105d013431f2ba6
SHA1 463ab4a4011fbcc5b68d3ffe0756a459f3a69ad0
SHA512 7daf0974eb16fc02f8de27040b766c2a6de0564271b05b42a3eb7fa04fe2b370988a911ee0ecffb2b5cfc171f855716581f277c09b4ade938e22a338695fca34
SSDEEP 96:nfkcy1W+uSwpvWMoiVmdevTmgNSVeA/4fq2Bjs1UWQyV+VDCAiEwb:nfkn8+lGWM/TmgNS4A/4fq2BYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ca91dad690c7015a22305ed9c094f8f2e76757aa0788ad44d4e13eea8cd252d9
MD5 ec22da98abc2f7dbaf645fe935a399be
SHA1 2b0f7c2424c343231a0faa1e4c547103591db715
SHA512 b02995ccdc10dc2b528a2b153a3c8270e1d54e0dadd6c76050daee41f719a53a6484c16a5c8c0b0ce1736c48c06b27108ccaf09a4897e64ec417555e2e1d5c8b
SSDEEP 96:nfkcy1WGuSwpvWMoiVmdevTmgNSVeA/4Sfq2BjC1UWQyV+VD7AiEwb:nfkn8GlGWM/TmgNS4A/4Sfq2Burg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 5f60e785cd5528dd6882b600d6baf452e776f7243d706c7e195fa990779a50ed
MD5 64e5e6d0b01a9e61c85766f8152f40d1
SHA1 c4f8a91fcc84f62d7dc744cbfde3aae276a3d502
SHA512 385bec3eb6beb2a8245fde56abc3af7d521f660920a242b2829c276127ad63e1dee40addef49efc6c6aec0f82c1b3fa7b26e0ade18db0b894111e53b0345881e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5816bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816bf.TMP
Size 204B
SHA256 ea7eb8f9c7f157f893839a0336b72360e9b4cc5aedc02affe219595f313e7f95
MD5 46cecbacc34089847e05a4b422496891
SHA1 6c0a23f362f1fbbfb2c9dd637ae007ce3fb29643
SHA512 98e9f92e495ce3cd7d54ad6bf600f1830f94147bf44b32ab3beec5cf6c479253a4803751710845df06e2d236a28ab86cc8e490fe4af708296f46c58d9febc785
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 95338755fec9ef51cfbddcc770f1e2c81d38efe2e9c786e28a745af81f65868d
MD5 20a365c95942a1325c750f2be4c96b48
SHA1 154a8372e080d04f78a33742a4e2f6964f55d833
SHA512 22c56eadc0b69b0dd65aa66b5493a16a485ea5a2c2941dd4c96c7cd42f34189bc697bb942704ea51d1ed3504df8065dceef94d2b8611012f22d1a04fc5f0e7c7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHe2RULhhN1K3wGEKu:A9iIxuERzA83h09RZxYvyfKCKu
MD5 SHA1 SHA512 SSDEEP

Submit Download