a40c67ecbd0a31d3e0633d34445def0366b90305cd5c28cc8f31bb213b850d5d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2024, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4b3b30fa982827ffb39c01645a0ccb9_JaffaCakes118.html
Size 282KB
Sample241130-ephx7a1pbw
SHA256 a40c67ecbd0a31d3e0633d34445def0366b90305cd5c28cc8f31bb213b850d5d
MD5 b4b3b30fa982827ffb39c01645a0ccb9
SHA1 4e62b46bd4856f3f302efc7997b1fa76c21e848d
SHA512 46fa281bdab2875072c1e653e74f8751d342955f079031a9c9473b0b77a5e0749fc956274afb4e404a12f5bbecbf2dbc6e373c4edeb73114a39bd8dac40d5ff1
SSDEEP 3072:OgW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/1BmGgkr3VY7RJvfy3dhw8S:qDAXmNR8/pQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
4912	msedge.exe
4912	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3956	4912	msedge.exe	83
PID 4912 wrote to memory of 3956	4912	msedge.exe	83
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2060	4912	msedge.exe	84
PID 4912 wrote to memory of 2148	4912	msedge.exe	85
PID 4912 wrote to memory of 2148	4912	msedge.exe	85
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86
PID 4912 wrote to memory of 3648	4912	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4b3b30fa982827ffb39c01645a0ccb9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7fff409f46f8,0x7fff409f4708,0x7fff409f4718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4960668668774991706,10033797226563599402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 23KB
SHA256 862e5db88bc456d003eeb9ecef6021b12a7313427596ba87eb4771020c658f93
MD5 abc48fd7cd6c006eb9f9c5719748c9ec
SHA1 1bfee875209e5a39e65213bd25322becf223d1c3
SHA512 62d9cd90cef344841d5f5acde94583c36d8541bfb6a61e72b6152d2054770ca3e056d702dc01fe7889a136972a12ce92057d84b9e9082903504cce730ef64594
SSDEEP 384:3ZHeuBAYC60CroMGQJqiMFQFosFCxcJlDbs7BFjzXQ9OTh2lgL:3ZbAL60bMGbQFos8OJlnm3nXqO12SL
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 20KB
SHA256 e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c
MD5 4b3121a05808b99aa6e0cc12924f77db
SHA1 ee5805bb76c384d1e1667aea2976bd2f4f94c7cc
SHA512 9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605
SSDEEP 384:R9uPagxu9HwpUsgANgyyEYVCdWByqa+bbovU39NDN6sM2E9NkLI:VwkANvR5qaWEvUN9bMX9mLI
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 dd743860c32b293770b1fc9e466c7578ed6bbd7ba21a65f39e7028f12ce51f0a
MD5 cac70bb9cff8363e345881e594cc4a59
SHA1 8ca1aee33b85c98bf419600e7e770faec7359aa4
SHA512 7a40ad10d43cbcd05898fb68cced467e28b23ca91f7ff62401ba53ccdc5802bb2d64eae25501147deaa1703d9e6abe7c3afcbc08fed411f4af4997fa12e67627
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ce0f067ec7d5c9b2ce0efed106f54d018257c979d379a68a70283b3580fad5eb
MD5 bf722eed3bee47925b72a6705b5d39ca
SHA1 cc11e785aa815b291b67b1b8a53598dd7841ea8a
SHA512 1ffdf9a10359324c4df7db35b8579c051ef8d602efe8b3dc560d8381c22cc8d455745f192010b155597153c0f63ba8cb45c816b760aea99d954a2e04dd3de3d7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 0da4ada0923720c62bd10e78db82a115c7afd0414194b1c1e47a3fa6a5a8e91c
MD5 998a8facafc989a237ec0438f8c58efb
SHA1 cfbae537749943e3998f7597569b05eae43c7a80
SHA512 1633c02ff56e211f299566517580b0ff0317c5310fab98fab13f25ac57375bd82667e56064e2be7f04b3dc43d9ed28fb9facd47801a5dc287a606a79a956dfc8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2d7cf2096491074a649ead07b9d54b05e3b4cd71ba9ab9298788b105b2265a60
MD5 d0aa8dfdc70f445420d105b3894a83b2
SHA1 1c6432868a817fab89de3120bb4ab1899481829d
SHA512 c8f722b35f80b6f21fc57e1da3683328b10ec966652ca2d6004d0693b917b1900b5fa396a9b73f65bbb1ddb65014283b0fb547dc23d7df7da6f505e7322f88bb
SSDEEP 96:nCukLSr1i69WI/wpvWMoiVmde/ReMYDKX4f+sK/+ONrF8GlxsqtuE7+dUWQyV+VI:n5kIE69T/GWMJe51f3KGu5uqurV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 f841db15e742468f0d0cb5cb7c3fbf50551db5d93437dbc5496e6975c0972908
MD5 24b85a0cf016bf625bf1f2d474249e1a
SHA1 87d1ebe4cded9aae1208b53b65fcce7516ef63b3
SHA512 54ca4f89c8c92506ef23c28e328b47518b24aa682985f7050079eb6ff3e409af7744cd482b963a100d86a52889eb0581e6c400115f82f029e1acb06817d1daae
SSDEEP 192:n5kIE6bT/GWMJK3e51f3K8MeCuR/qlErS5u62rrV:n5VE6mWU3AMXrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4bfc528adddde231626485a9adcedcdd2478e2c0711a0324a800680afee23a26
MD5 19886921752f77774afab7844edb4f2c
SHA1 ab581232fc3d3b47c2faccfd2e3a6c085b860333
SHA512 6369d8fac8887538b9e7d6203519a448b5f6d0392cc4fa9bd0645dac8774bbcf2f8478a100d346397553f8574e9931783e10d7508853611fdf43941e068eb8f0
SSDEEP 96:nCukrSr1i69WI/wpvWMoiVmdeHtuE7+dUWQyV+VDCziEwb:n5koE69T/GWMXuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 48ccd09e89ef5aaea5561e45340af4481bdb38c3f4b24e55868b730c6cb1c31b
MD5 ab4c8ecbd6ad1e69dd9696ff4e8d5b00
SHA1 e45205c668aaa717f537dda9cf5f2509f76ef211
SHA512 8d4cc0396dc605c730016e2fb543e4bc09ff8a351fffc71965822f7f587ffbba11d8bcc8f399fcb1100b79ed11c6babb880572123261415518516b546f68a958
SSDEEP 192:n5kIEqbT/GWMJK3e51f3K8MeGCuZR/qlErS5u62rrg:n5VEqmWU3ALXr+
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 8b8f8fb9ef09b2218e44b199191ec07817302acc0ed245e9091c6e9d06a4bbe3
MD5 13684981aa476d2934f515d1ca5b0720
SHA1 5d2b32f852d9d3db538f875e99feb2fb2e7c8686
SHA512 6bb2577b2c75a6b6554ab444eb7e625a8eb40f916f1d69dd8738ffd872acd266273fd2ff8fadcbb765e45ca8348c0c13e9eff9ff8d0584d5d259aee0e5babc49
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 8b6c3d2d1eb5c4d35a375a0657020dcfb8bc3ca29df24e51db1bb801a451716c
MD5 d04504b74f57554e0c4e927710c61ae2
SHA1 b161fd12fd7c998139b096761da0db62badf0cfb
SHA512 ae368a512f2fce7ada1480f8f19c079fa770a2c9a5778d95e135a9aa7b85343234ae81f70be756f411062ae44bd66315dc6f14646fc611c51da9a14dd986cab6
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 571aac336a0de664b0e28e5d4fcc723aacbd35aa104323cdfe9cb3c5f9d28cbf
MD5 9b6d0b114fcff05ed5ad1c6b4e7b1204
SHA1 393145f6ed186e2c4be3c6b425ace2f69fc704fe
SHA512 2bc532d46e3b86f5b5d2fb1d8738e6e09d29a686d785cb7a57f6a2073411d6c2eda6e02c73fb5cb9e3ca2c066f7cdff374de197abe1a0734b8ce277e932d8e87
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5895b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5895b3.TMP
Size 203B
SHA256 bb3ee71aa16cfa58921a31a47234dfcff4c83649233fae297e751f9d67f1b047
MD5 efc4dd530f3a8f921d67ff5d7186bcd7
SHA1 cb6ac91e5250dff0abacc484c9edcc78391f0ef9
SHA512 08f809b89406de4c5c120f12f05e40aef5f37e2aaf2cb0c53830191ecd5806422b3d6d4456cebf78aa0cafbd38cc3e0d2d817adf0a6079a6b9a7f5f3b5936106
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 48356339df277a29e21215666833023e648566769a5aaf200ce6798e5a5215a8
MD5 f1eec76c4787285404afbafac16b9745
SHA1 975a20e14cbcbb71e1b45d46be265de92436bfca
SHA512 558c8f8566f67496e4b2a1f4014c71fddff58c1f7540917e406c29d985237b3aceb64a33a0b17dfa698d0141b498dc57ffc2a4629f0c6259160ed99095ea30b7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSe2RUCobyYdF980JQwUHZA:A9iIxuERzA83h09RZxYsGyYi0YHu
MD5 SHA1 SHA512 SSDEEP

Submit Download