ef5547bbe35894edb7be044c73fc336408f4be44b6a7f979dfeb5a8d71adf972

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2024, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
762d2a54b0eae1c6371a20f991f3f92a_JaffaCakes118.html
Size 146KB
Sample241027-1146fs1mfl
SHA256 ef5547bbe35894edb7be044c73fc336408f4be44b6a7f979dfeb5a8d71adf972
MD5 762d2a54b0eae1c6371a20f991f3f92a
SHA1 f4ca1229f49873d4eaa1a36155ef953bc8ed24c7
SHA512 21d399c6d3a7d28a32c04f84a793e409b02a49c804473c9ad58ee823b235e2cbab1738542d2063114c34371563080387d64e92f81090226e548eca4c6ea1713d
SSDEEP 3072:O/2iKZcJy3/7Uyn/o6UoFTnlaYFQyYFQ9YFQXqkNJq15mxAEZJAUHUopiLFu0qda:O/2iKjngohnIYFQyYFQ9YFQ5fATE84J8
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
12	sites.google.com
18	sites.google.com
19	sites.google.com
20	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2616	msedge.exe
2616	msedge.exe
1340	msedge.exe
1340	msedge.exe
2752	identity_helper.exe
2752	identity_helper.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 3484	1340	msedge.exe	85
PID 1340 wrote to memory of 3484	1340	msedge.exe	85
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2488	1340	msedge.exe	86
PID 1340 wrote to memory of 2616	1340	msedge.exe	87
PID 1340 wrote to memory of 2616	1340	msedge.exe	87
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88
PID 1340 wrote to memory of 1600	1340	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\762d2a54b0eae1c6371a20f991f3f92a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8e4a46f8,0x7ffd8e4a4708,0x7ffd8e4a4718
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,16656666657197378869,16486653212460951306,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 20KB
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead
SSDEEP 384:wPSxXxKeJEsjg9wbw1t33eVliNGb3naaE0QmTtcOJv4FYUdrAd1bzxvp:BxjJZM9YYOVliNGbXrQ83ODABdvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 d11a49e74380146fb4da15fbc7e722b28cb3413fe540ed04a280d0265c32dc38
MD5 1efd396f03b3d5e97373b950d16b77ec
SHA1 adf1dda310be67b1a3e97a6b5458a448385274fe
SHA512 fafbebc03b44e62aed44b958265dbc488790a47c269b33a8779e4cb0302a5dee470ed6fc33da3336c39c9bc4c955a93e4116f16c54da2f5f517d8b6720f83638
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 f433d9afa38bc5e91ce1c723ed0cb9423b65321adfbd9f1e19b957184fb5c817
MD5 d50b3551372c067a6370143b7ee44f79
SHA1 203f848ed8fb60f099dddf9f35df7f691ee5c9d0
SHA512 fe96d7a1a3f52098f8a36c54ab4ea5bc678c593cc757749e8cc0777e1812c254525d7b7a6fd03253704a1d6330bb01d17e5b82c2fc97582d5f98dd6ae56aff50
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 e5900065a01ca03e5126e649993968e5427ee48bbdce684a6e9c21259b34ae8d
MD5 5e019750032db0b5cd6fcc4dc86502a7
SHA1 6574587998f2047edb691a97fd138ff66f83cdea
SHA512 fe778cd83d0222d68731ccbd07816d62d8d7c7f5f247359f62371d22297d455119ccfe1324408e3b148ef12a8f2cc10946eeda4b10a610ad26909778984cf42e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e044861f94ad9dcb4b4a4d9b43cef2b7cf5d588102c597c00c3c00a89d985af7
MD5 75d738c8fb6d60f07f900dd62a27883d
SHA1 88259494895d46f3eda60b598fa81b7878ee4700
SHA512 cded0b90d227be6678d6ee53884caee4ca118fbcdf9b445e54b9ca9778a766e4a10cdd0c534c27f7d222de44d9ee975f319cb29a89b1a1522facc0de93b554e2
SSDEEP 96:n6kcxgj16UqbwpvWMoiVmdewPxq0MY8tK2642Xj+f4UWQyV+VDCAiEwb:n6krRqbGWMAPxq0MY8s2T2k4rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f5f24534a5f7b86fff1258ac72a3e285d0e32f19b614cb4802376d5f452d4bc2
MD5 a0b327ee6dfcc42607a6332e24fe5a31
SHA1 cc553482bdb38c213da5cec45708aa20bdf106e0
SHA512 4d201f79a54f3cbf049036d8ebad7a0ca72497d2a0c94cd288985e0d55f486ddf96dc16f74bd14dbb93ec01d8330beaeee7ff54470018559a31eb5c4961a535c
SSDEEP 96:n6kSxgj16UUbwpvWMoiVmdeHXj+f4UWQyV+VDCziEwb:n6ktRUbGWMXk4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b3c4a4aaaac30640a4c461f53c37380e2a36518dc9a0d2275266a8d444ae3455
MD5 df04efca672bd8118eadea8292f020d5
SHA1 ef7971a98e7810e2dd3a8db06962a73f7d5197fb
SHA512 f971402993eeeada829243b4e3a84ad9b91f79b3af59a612a77aa316027cc69f213cae15db06bb16f49fb7d23e6922abc2697c223be62ca60a0dcfeb28b55ff0
SSDEEP 96:n6kcxgj16UqbwpvWMoiVmdewPxq0MY8tK2642XjJf4UWQyV+VD7AiEwb:n6krRqbGWMAPxq0MY8s2T2N4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 87dfc13da3b03d6b6be83d7fcd6ed8a156eeb1ef072a6e44b7a4185c0c7c079f
MD5 cf308d4ab4c063bc98e505f0413e1c62
SHA1 94d7877d313d18e4c9c04a898b892ca4edba3c78
SHA512 eba434197c37246e6b06573c80366de7d8de5b07718104d9ae9d9104aa146a098640b9c053d8fc4e4ad4c881240a570ea4023a710854bdb3ec24ba31f4ee0fc7
SSDEEP 96:n6kcxgj16wqbwpvWMoiVmdewPxq0MY8tK2642XjJf4UWQyV+VD7AiEwb:n6krRqbGWMAPxq0MY8s2T2N4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9c711c3eefa086e8e3e244cfda58c7038a243ab3e6a92f25a4c5a3974d489da8
MD5 1fe1a3604b041540e4c6151b51c86b54
SHA1 0f280c1438e94a1d457a5b0b021610a2361aa645
SHA512 f0fd8624e46961384eec44eb71971930d37752a49237d7df6080d3b308045dfa414cfdcfa61a72d689c9c90468bad7566dc70b5b157f08520b82ed8d0bd94007
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgEbe2RUe4nvLHqRUx3GPOB:A9iIxuERzA83h09RZxYVGvGSFGmx8oQs
MD5 SHA1 SHA512 SSDEEP

Submit Download