373f5768b0f8d285f438db49935294881a52946ba4454ec783803ec3e69139d5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
af176d95fcbc4d9683f7750d42593669_JaffaCakes118.html
Size 218KB
Sample241129-ftstmaxlfv
SHA256 373f5768b0f8d285f438db49935294881a52946ba4454ec783803ec3e69139d5
MD5 af176d95fcbc4d9683f7750d42593669
SHA1 5c317cf34687d3a487d0a3834f4a973332943cb0
SHA512 d4429be840dd7a5c8a58db9aac966943ff6310dfca245b91b51d0cf240ff485a55c1014d25877181905deb2f533e94da7b8b272cde636851e75293c489aa45f1
SSDEEP 3072:7okclLFodthxh8S0ijgrrGVS2a4CeFMcRRBGgscnRyLBSdKBHCusR60lCqbuXFkp:8kclWyMS27PtX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1148	msedge.exe
1148	msedge.exe
3904	msedge.exe
3904	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2100	3904	msedge.exe	82
PID 3904 wrote to memory of 2100	3904	msedge.exe	82
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 264	3904	msedge.exe	83
PID 3904 wrote to memory of 1148	3904	msedge.exe	84
PID 3904 wrote to memory of 1148	3904	msedge.exe	84
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85
PID 3904 wrote to memory of 4968	3904	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\af176d95fcbc4d9683f7750d42593669_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff877f846f8,0x7ff877f84708,0x7ff877f84718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,18017458707921635684,1955211625688340083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
MD5 b8880802fc2bb880a7a869faa01315b0
SHA1 51d1a3fa2c272f094515675d82150bfce08ee8d3
SHA512 e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
MD5 ba6ef346187b40694d493da98d5da979
SHA1 643c15bec043f8673943885199bb06cd1652ee37
SHA512 2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 e353c256353a8a893da6e5019eac66d4f545cdec782d9ff426a9039b43e67592
MD5 84ba499574a5c948104ae4c7bd001c23
SHA1 03c26d9cf60068d5ea0472f764b986fe9f5dbe0b
SHA512 51ed1bb24b2316fc38c1a9c2060ad2c5f7d87897e68ca93b2cacad6144abae52c6897ec6719018d93488ea119ea8bd5b60597cb813e65422dc31b364b7f3007f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b2a0aa1f9e3b648ad0d4bd3ed2350464d8fd4469ae4d413084d39b56ce8e9762
MD5 fc83ea6c30ce8196ec9e15978b467e19
SHA1 c8124e421b1ebc291333aa08e0bd2d5080ff7785
SHA512 22bbc0acc4d1ff0a69fb35aa56fbcebbf9ac251fef46301d7cc058fc0f3d125c9f95c6c1158b3028404277cd951ece65fcfb227af80b52d4900ee59c5c1a4ceb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 615dfd4d364a9a832f5d7044c6af880948555299f2bc4d4c344ea91b0be69e19
MD5 6632039cb24c3376241494f3d54d7a7a
SHA1 f0d08e366bd9cca7dc9e7efbfef0115cd40b0cfc
SHA512 c4ef71973f994b0b3442cf47083da453bec96d60f064f0910b167ab3d7d68d3cfab4904d75c044d6cbf2fc0969ab76e5fce2d40f0660845b18626d4f7a4d25c2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dcda35c89eb5e8e91fc3d204d68885f263ee3807d8bfccd28037f3a41eea05cc
MD5 9a9e5c0614c2cbfbf15b22381f4a25b4
SHA1 85bd4801e67d4d8c91caef548adfca25b20b4026
SHA512 aeff35dfb19a9b49a2264434c02b0e018782721ac0ac1ab60b0d59773688948dfddc88b98e2fbd4d810c392137753e277edadc7a6bdf7c6d8c0fc29ddc2fadf9
SSDEEP 96:nCnkJSx1k0FwpvWMoiVmdeHAnKe7fIUWQyV+VDCziEwb:n4kUC0FGWMXGKTro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ad55d0d11590e84d37562f77427d440e7d657585c8741ff17f97ab49e717472d
MD5 ba70dff2d47c531b58b51bf4de5d3ebe
SHA1 71991e4188ac65f20e297ddcfe3457f30b5c576a
SHA512 1c59fae1f14b64c97aa2b7c347ddd4378fc405ec97032876827022abfb45190a6fb8646ca487587fe0e4811074c00b69877eb6f484bcdb5b56f1592bbb16fa9f
SSDEEP 96:nCnk0Sx1k0FwpvWMoiVmdeoyYqEc4TIOrEu82AnKe7fIUWQyV+VDCAiEwb:n4kPC0FGWMEDlcEEv2GKTrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 88d6867a924dc54c0a3b1d6e32dcb9e24477b8409b3875745e2a36d343efe736
MD5 d435e473efec9fd1c8b8f2df946d193a
SHA1 8cecc6ddd71e44e0579211b1be922f78bef4bcef
SHA512 7aa013d806611230c301c6d194b716c2924d9b3c5c148f76c68bf904fbb8cd517a52e1ce7e22aaeffe9714aac9eb4c6408d05e92efe3c6ddb3bd00a968ca1f91
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6990e091828ec8597066ebcffc8a8abe5368fa60a830ab31d3ed99d01522ea15
MD5 bacab0e571cc6ff3bc1b48c9d222fb33
SHA1 d979f5e87a9742229faaddd9eb84884df8b7966a
SHA512 0bde4381d5dc8f1a58745730296233fc54fe724734689d7ec2473fc106969c0fcd4d2349f356ed74520c09a89aecf7fad41407734f757438f384d5379d8c879e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58461c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58461c.TMP
Size 371B
SHA256 b26447635c3fdf7dc043b2729c1db43d3846802b1136a23033906fc88d2c790b
MD5 a91b0b210fbf6a77e85448ca0d7e2790
SHA1 8c514bc5e997d71d0e971686395e18768a7b1aaf
SHA512 d8685af94629ce8b0bc9a7c0b0da284448b48f92b40d57b96a95476f2d5b07b7bebe3f8b5a9cf0db5b6335582387cf0822bd9604ba29dbbb20af815906cf6aa2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3f2cfba0710b3c89d4519e1e873ca521bb78ef3656058dc1f68612e0a5388395
MD5 de566dff5b3d40c1d6c57b539e630ba6
SHA1 edf5231dc77ce86fae1cc6955f0f32fd90de6231
SHA512 47ae7069016b243fadce40b5a08d211e04e3b1bfc873829eff52717963b3beb2fd4559e9f9402012e3065816236a7238f19bb08ed09aea31edd4ac619432d587
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupm1e2RUsMkNgYdF980JQwUj:A9iIxuERzA83h09RZxYmxPgYi0YCu
MD5 SHA1 SHA512 SSDEEP

Submit Download