8f3254153a5744a3ff777b94c246a6831a52720692e7a66c0af9eac186a2c30e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c9925fea704407bb3e292dcf6e8a6cc_JaffaCakes118.html
Size 89KB
Sample241103-vr3clssken
SHA256 8f3254153a5744a3ff777b94c246a6831a52720692e7a66c0af9eac186a2c30e
MD5 8c9925fea704407bb3e292dcf6e8a6cc
SHA1 3c96ebce12e9b7cd023dfcb20aa7c59df225e48b
SHA512 271a9183efc339eb503ab1b0312043b283eabf8137f6347a97c180c91274d257520984c92d72502b97cf374cb48c960ab0ad5ae1c4d58540d929e310156b898e
SSDEEP 1536:Q6Ob+ZZ1a75Pgr/O2zt2tuN+8hdcqZmiPJ7iaZlwdq5:Q6OSZ/a75PV2zt2t63huqyaZlH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
4848	msedge.exe
4848	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4852	4848	msedge.exe	84
PID 4848 wrote to memory of 4852	4848	msedge.exe	84
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 2892	4848	msedge.exe	85
PID 4848 wrote to memory of 628	4848	msedge.exe	86
PID 4848 wrote to memory of 628	4848	msedge.exe	86
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87
PID 4848 wrote to memory of 5040	4848	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\8c9925fea704407bb3e292dcf6e8a6cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x74,0x108,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c4718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10525598028569957851,16457984948297724780,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
Size 20KB
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead
SSDEEP 384:wPSxXxKeJEsjg9wbw1t33eVliNGb3naaE0QmTtcOJv4FYUdrAd1bzxvp:BxjJZM9YYOVliNGbXrQ83ODABdvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 384B
SHA256 4f320c34816a20938d0d984b3d0a045a4de6439bd6c34d6fc55b133742aa4e40
MD5 529179b4474bda38ae4ee9f98dcfc741
SHA1 45b5fda0e53aa5186bbad85102e9690a41b53cb2
SHA512 1b76fe9b6184a872cc0bba993bb6588567fd1e2edfaedd7b613b5b442f8a6600ebe78fa50ba7264c6c6f8ca6dfaa2f493d35f873de7289774a4d03da5b153618
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 c341b9d7cd4f7bf42391f621176b548b9047ef09730f47871df6eff95d08ae35
MD5 2a3477114a81823b37ee283cc2b80ff0
SHA1 2effece1dd86789a26a8b8ef7e818b071ad8077c
SHA512 673170b10846051b8761e50481554635d400c4aae9996f62304dd235fb433b4d956a4fac938e1409733e151026e3396a3fa2cffa0d16c2c966714d9320ab0ce7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 eb1a36f90ebb4f5c30c9666130a9c757728d673c374fba0b5a3b94c1713f90cb
MD5 59c377d5271d3d7ea012bec7563f08a5
SHA1 280158229f19a6747acbe9dc2b533e86c88a6a5a
SHA512 4cd8cc4c828a18dc3d47955a55835d21d482d394aae6c9b5105d54d2e7e2675ee8528413b7d87578eb748808944e1af8659aeae4c98b286f344cdc8079f5d7dd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3587c5a1200b8b73c7469d515f56952d1defbfd2f379626c473ce07e114b52e4
MD5 8b5e3e2537dc52751f8a1738922e1bf9
SHA1 a7a1f2aff59ba6efe144d1396fcc95c6b78b06d5
SHA512 076b4f9466b2de4173da11f082b4cde54b0c061675acce5a7f2bb00d8feb1aadf133cd59fee366392b89be1ab2be2b9eaa8853f1fd5609baf736a6670c2b7d6c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 369564a522c07874aa67007303c2e527d0fe902041d585594f9c8fb64dcd4d6d
MD5 5ff67a2418abf2f2b184a3a05d960d44
SHA1 1e7185f939fe230c1c183673cd786382cf1e532a
SHA512 f1749b7c7174122311bed5e5f3a6678c963c22e568bed1ce53da0c6193c365335321dcbb67632cc8d3bff04b7d9769d95d9e3186096d61e9272d4dd9bd18db57
SSDEEP 96:nekLC1oYPfkwpvWMoiVmdeHycDi+UWQyV+VDCziEwb:nekOCYUGWMXJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 c436505d69c665e9600d5e315b8a0879101431d57bc48eac04969c20a2649c1e
MD5 eba270b71d969f39a48348ec47898ba2
SHA1 5d0447d16475af1b08cb55d788e042f34834c2db
SHA512 a0081a33de9f6c0c509cb8625ae31c56249a91e147099bef68f33968deddf2256d820da2b3db2cc0d911afd5763595217412496802131456edd33dde96c883d0
SSDEEP 96:nekfC1ooPfkwpvWMoiVmde13Q0FvxaSIRwmhEax2yYxDi+UWQyV+VD7AiEwb:nekaCoUGWMl3Q0FvxaSIRwmhEax27rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ea53b59f3f9ff9b1476c9412d67f39c9dc1568057b204157fc2e84f02d7a6de8
MD5 37cfee27197504631cefe47cbd7a88db
SHA1 244d433d6f7c8a6d16605d478cf3e30f0f198777
SHA512 be6a792222010b10f57716ea992257715ce21e8b728ab17f0ea25e6bcf2f97a1f2ff12e722610faf91a2e67c6d79eb9f5e0971ec92f4779734aa1dd7e4e50976
SSDEEP 96:nekrC1ooPfkwpvWMoiVmde13Q0FvxamhEax2ycDi+UWQyV+VDCAiEwb:nekuCoUGWMl3Q0FvxamhEax2JrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 693c1f39cacb08720b61a52b97a7daa37303344dc9ddbf147aed2f53d69d6ac2
MD5 613038434ee1df3e0b298f92faf80100
SHA1 11912aed837d48346eecf16513672da2ca3ee9f2
SHA512 9516dd1a16a3ae1f6cb4883615a0400d4c4f7e9b89e853691bebdfaf86d5645d52644822a0f9c9fb5ee8c96ea4a7e61ed9fc1beda91425e95e0b84494dfa1f82
SSDEEP 96:nekfC1ijoPfkwpvWMoiVmde13Q0FvxaSIRwmhEax2yYxDi+UWQyV+VD7AiEwb:nekaCoUGWMl3Q0FvxaSIRwmhEax27rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 432fa9935a6559cdc1d6507fb1e23dab4e5f23aae0c1e7e1c77869a0240304bd
MD5 e5a2aee39ccd53e6e245f792b421ae2b
SHA1 465882c49d54180054deb15b86a9aaa2bba73231
SHA512 b7b5b82105162da02a1e590b7bbf708616d20fc4baf668830fbdc53f0a1e17d3ec7038fda7f8c134aee7333be2f8ca848e154491d319b8a3bb29966b28c4de34
SSDEEP 96:nekrC1oYPfkwpvWMoiVmde13Q0FxahEax2ycDi+UWQyV+VDCAiEwb:nekuCYUGWMl3Q0FxahEax2JrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5618abd5dd942fd81383d5359c7b1d2b25e39ce57162d1b61150051320fba2fd
MD5 c061bcee72af454fbd4a737807bb541e
SHA1 6b7657e650c7ee1685e085bfc498be9337e60211
SHA512 53bc10a0b8d54361413fe7b86ab2827c27438ba22b9069f93a8253999ec5dd85fe6525f92e3aff725486e7efabfdd496dd9151c134d3482d9e26aa4462f758a1
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+e2RUe/p4zHuHqRUx3GPOY:A9iIxuERzA83h09RZxYgTIHxSFGmx8oK
MD5 SHA1 SHA512 SSDEEP

Submit Download