4052bab1c995fb55a678a1865ede013770ecd2871f3ff1b48085653437a915d6

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d46dd70cabe644e968e13696973a3c67_JaffaCakes118.html
Size 163KB
Sample240908-qcaa3azdpe
SHA256 4052bab1c995fb55a678a1865ede013770ecd2871f3ff1b48085653437a915d6
MD5 d46dd70cabe644e968e13696973a3c67
SHA1 128199c51b083b50e0a818a3b56e4f03d1d7c8c7
SHA512 b21259ff6018b2629bf8b9b504c5b03075bf01393fdfc066ab5e789389ccb8afa12ba397d1669a152c33f2e797d8cb28c75ce87272ddf9d31abd074fb03c4f18
SSDEEP 3072:sUrYur21BjVybbeeZKGhoQzB3fEU6+P9nUAeWhYHTAMOgI:sUrYur2MKVUV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4608	msedge.exe
4608	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4596	4608	msedge.exe	83
PID 4608 wrote to memory of 4596	4608	msedge.exe	83
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4184	4608	msedge.exe	84
PID 4608 wrote to memory of 4144	4608	msedge.exe	85
PID 4608 wrote to memory of 4144	4608	msedge.exe	85
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86
PID 4608 wrote to memory of 4232	4608	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d46dd70cabe644e968e13696973a3c67_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff379446f8,0x7fff37944708,0x7fff37944718
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,17118196402439578171,90641557048830906,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

0dc44c4d-55d8-40eb-8df1-6348c7a86d6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0dc44c4d-55d8-40eb-8df1-6348c7a86d6c.tmp
Size 8KB
SHA256 9ca5ee51279be2f353cd0c6bd1f1a13a1625bd7126b85e5cc7b8634fef5b849b
MD5 f3bedd73071f964b5fc6c974178f45e4
SHA1 1fdd0db64244cec17aa8db1a7e45ab29984f4486
SHA512 aeac6fa5d7bdc12db5de3d547249c890d38e7ee6582e6915eb07d0cb9578687056e9a18e307a59ea310810e41e00a000047443625a73ddcdec94db8dadf06ffd
SSDEEP 192:nbk/usVGWMrbfmZyKJMkrZ4OLTKACpqxrV:nbfsoWX
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 23KB
SHA256 6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8
MD5 a0423f1305547bb6b8f5a4fb1a9fc2d8
SHA1 092dcf1fe57e6bb53821eb754e04188ee70602d5
SHA512 b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3
SSDEEP 384:aAW2VTWfhCNc+bzBo3WuAi3FwN/f25rCT2LduMZ6wHWPbcb1xDtun1GrR1+4JdNE:aAW22hCNc8zQk/uhLdue52E1xG1QCkPE
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 cb2032d9cb19942b3b7254a1db009e8a5922066fcde4de7edde0c78c04354355
MD5 f4d01d8b7e36b115ea3bf9c4267da95e
SHA1 b9a670148ab0ac80fbd6d42adbf7a3811be11b8f
SHA512 e94a0c6f2e18e427d41e64dd81330e25a420f982a8362b39b99fe150116264a9119eb882a8c34c463bccfc2c4f42d7d80eab97dbf6dc79921ff5e8a315c4e124
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 86f20f6a4679270e45c251a1292cccd548fcaadae6ee37a6d9bbba2f88f026aa
MD5 9f5c6e275775471f21ad72fda7847bb2
SHA1 b05cf0b8c604a642999d2b79e236fb3ebf077a82
SHA512 70979c9825f57b00c5b50305e22b1e946676eb284655d0e7c2594b87eeed2ea75b23bb95a784df5641cc4fa15cd87e588f871313bff943edfc98554fa4f7a4d2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 40fdb710150d9ac6fb985c2d085d882e5f611a16cc5711047cd1ee927accc121
MD5 cdc6f65e648c8c89ca0d7a3819036f1e
SHA1 0afdddbb9862bcb75fa103d8aee012a2750ee241
SHA512 3da5a4a4f4b6497fc43587c1d1d322bed26dd1a6debd9722b277a90ed2858e8984d33e7de8af90dfdf440d0a3ce5f209651c68589a1031e3298cf3631d437921
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 3e0e26861c3bdf1053f5f70a39e6727bc5ccaa98a7a50d63d5632e882d66fff7
MD5 6ab8cb3f6460fc5e8b3444fe51fb2927
SHA1 d05eb722a993e25ac32e73a1fd6f31b1cf43db92
SHA512 7718efffd9a8236fdf389402871bde604f86e66f6d5d4398d097e9facade8af864a2ccf10a2fd24eb4b0503e76a74fecad8b1d9a76365001637562cb6414985d
SSDEEP 96:UpB+Gf+/OLR6ra7px08o8MG7GVG/GZGkEbGAGJQGpGmG3GlnGe7A:UpB+Gf+/OLR6ra7pxFo8MMS24IbxlMXe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 64739db3f145032c24fc0ef1024d0915e3635856257fb453e495fc52b392f1c3
MD5 174ae6e780f06bcbc55ad2ed47c4e1eb
SHA1 75ab7129ef6f4deb1840c60e53c3ba99b17b63e6
SHA512 1401ab9f72fc020c11ecaffc39a0650d28aed98f71977a1167a010cf5044e6e30dcd2ae89d176fc6c5ba443dace3c6d7631618eaa77323aa41710f1e5b8283c3
SSDEEP 96:nbk/XG1SVwpvWMoiVmdeHm9CUWQyV+VDCziEwb:nbk/WsVGWMXxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 d656340e6d485174c4fed85672f9eac4082cee7e85ef053a9a2b68d864574d82
MD5 6c49c158c16eb12b0224d63c903e8e56
SHA1 3c94ad8aa86fb06e93804dfde4fa25dd4bb83988
SHA512 dda85a3fec9f3bc621c4e82b4816d49a34cca7f9f5709b8803a78dec03fd1dbe449351020544b8fc8ef6aac8c68818b104fbb5b93a74063d1a4cf1c99f41a6f6
SSDEEP 192:nbk/usNGWMrb8fmZyKJMkrZ49O9nYPTKAyZdEr0lCpq512xrV:nbfsAWvprH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1832f80ec6033499ac711e11d557614ae94aaf27e9cebd622e0ff0ba603dcd3a
MD5 150687ffc7f783bce6252b49cd48d212
SHA1 bca225307e28c914548f865ac2b07afbe46825d4
SHA512 a68be4e39a1ced3bcbf46020c58b30da44602fff7af923f81e296e8896c7e57a74f5a0c22331d87d6e196769b156d3c69af7d60d296fba310a23159fc2490843
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e81e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e81e.TMP
Size 370B
SHA256 161d8c4583464b8b1eef352001cf8ff04a50d00aa1df0d2b4e896f6f4a7b5fb5
MD5 46ec2fc71d77c18fc5703fffb592ed5a
SHA1 90ef85afc2fcbdedde1bb5ec8fd6ad398702ba65
SHA512 8596a6ee4b9e16fdd29ac662315ad22d577dbd183b7af9f75b203cbab2017a4bfdd3e331ada100e5a2416d0b13a82b63f2eff58e039f15097d0cfa155e0ab742
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c21932959ca629239f1d93136eebe5e96c7aaa9651b21dc7ddc78bacf6a4d079
MD5 21ec38a6e90b25cc3c5e8d4e6f84b6ae
SHA1 c1fb5a373054b43b66c4abbda3387a81669f35ff
SHA512 3ad4aa2cfb8d271d0ef4be50b52ab1680460725b0fac5e11d863a94922086b0d955f52268041723be2046b1eaa80347e341c02b35f7cceaa82b85e7a3d94b548
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMe2RUzlYOpLQOl6feAOH:A9iIxuERzA83h09RZxYSqpSe
MD5 SHA1 SHA512 SSDEEP

Submit Download