bf4d5295ed788dccdf5edac5ce77c2b03c6bb065011926a43ba816b2712534be

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fe0ea1888371d03c996770e50c7114b3_JaffaCakes118.html
Size 170KB
Sample240929-jcmg3axeph
SHA256 bf4d5295ed788dccdf5edac5ce77c2b03c6bb065011926a43ba816b2712534be
MD5 fe0ea1888371d03c996770e50c7114b3
SHA1 18547ad0dac8367cbf2e8f89759fbe04fed8088f
SHA512 bfc0bca51671e63ad243b5f6fb374add14c90b20375211df6e4e88e92caed81964a1a790739ad9b1ad274207a00a840055842e877bb066f5c283a3bb87f89805
SSDEEP 3072:sZlYu8qzt8aNn63AVobeOJjy+MaifkdfARUa+S94nAnWhY+CAMOHBZ:sZlYuHt8aNn63AujyZUJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
1104	msedge.exe
1104	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1788	1104	msedge.exe	85
PID 1104 wrote to memory of 1788	1104	msedge.exe	85
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 4072	1104	msedge.exe	86
PID 1104 wrote to memory of 624	1104	msedge.exe	87
PID 1104 wrote to memory of 624	1104	msedge.exe	87
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88
PID 1104 wrote to memory of 4528	1104	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe0ea1888371d03c996770e50c7114b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7659218324816257960,405648325365582761,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 47KB
SHA256 28ba0b7e3fa6070799b7d8a5a166a1c05751948059604b835c7a9e53e5668fd6
MD5 02bac54636d00b4059602a7d04ee6d41
SHA1 181ea605fbf32bd2895a9170873b6356dc37748f
SHA512 be83074f59ae14751cdca5ef08b5e4422754dd013a13f1071e4a58981d0accb17449f9764a0fc33577980b4f7ad67a8e6514162f761d91eafa5d17f22b27edfb
SSDEEP 768:61cTkOISSJda6ygVnNLyfjSNnFfdrC0RGz7KXsa6nT6C3nKvBtKBdsIOpRZH:66IOxSHt10LStTg7KXrC3KptWWRZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 20KB
SHA256 a198784a84746248afc1a9499843cb43a6c4da9b22bccce509fc08c97ab04aec
MD5 17e99a39a759be8ce3553fbb3eea504f
SHA1 ee2ba8053f87d5eca8dc517369e236eda5a737c1
SHA512 2d2ccaa9bc9b8c2495da1cb4d41f2eade44d6d146ba9c8c937ba8e9220489c79cae184b36eeb5794d4ca40b79b434e065aafed6a62d1184bdffdaa2bb24f7fc1
SSDEEP 384:HfvOauHZtq9KzgufY7UQoM9eyRH5dTv4wkMVUaGtmR30siZf0ix2J+W2OuKj6ri:HfvOJtqRUY7/9eCeAUvmRA3UQ3Ofj6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012
Size 41KB
SHA256 a4e5e895af7992f5f111a2af5e150460cd482eb777a9181d0995a43bb4913621
MD5 76e960b684eb71c2a06f96b3ae5b2d0b
SHA1 685a884d4ce4ef89a5a80bc2dbe234ef5844de95
SHA512 ee3749f05fc78f7ef19438499e9a603300708092af026a71ad7989d72f51ba8f63889d23cde421d1e0baf482966288b714e342885248c98ce52c795cfd271cdd
SSDEEP 768:aOX/jdsn7ZRu0lXLWWpFfQVG/Lqyr07Qq4SVTFEJCqs7Rw4Jy:9X/q7uQFcGmyIASVTFEJCqWw4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b76bb94b36a5e84099cae6654e5d986712d71739131da8b900d7fb22c339dd6f
MD5 b75b0c4fe2e9c2183b83d29c04637bd8
SHA1 1175bac7533fbe8b5bb7179e67d50d9898ab5a21
SHA512 05bb031f7435de53abff1472a0edea9fcd769f20afce7c7d5715b2a6408013c89c6fd947ddadfbd749001e6858ac2b8cf1e150d95756812bdd3efff8706e6370
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 6f15102a856c3e3bbab71855b58a16848085d6393bbe2a0070c2a7d0301ec6ba
MD5 b8eed9cee6f0e3571b2bb51341e2d1c1
SHA1 c61e94a0be604c3106961d82728bfba36eb3f9da
SHA512 4c961c32eb0e3814bcf07aea0538384abf2a16d08cc07658e19310873d69d55978908b8c1bf5e2191c0583008e13af31e224f89d29cd2512cb9e88c5ed0e42c6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 8eefe4a78f44e556750372e7af771ca3717c56195f62f4ea80944e9810ddf11a
MD5 5b8885f378fb878d2352dc795f7c91ea
SHA1 a7238c6abed5e9efe01489d9844683ed025160b9
SHA512 e11acb0305aab0a552af32f9aafac291333b9a56da6eabc6f7aedf6a309fca49956d890b383cecf0d325e0a6b3234e8a424ea0687df0e5e43bfc3279a67f6f10
SSDEEP 96:anys8LOd6rFX8GXGMGd8GFGooLfEx5ET087G17gGkGCGMGGGZGdzGmGME+j:anys6Od6rFskT1g+LfEx5ETF7W0pz9jt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 5KB
SHA256 651534d36c405521b8de559ffdfe1ca03bf68c8192f5a43689b92540b2b1be10
MD5 819fba4e928eddd3b6409a7262ff58c3
SHA1 f7e7535c92288ac66800ac3c25127e2cf9552b11
SHA512 3bc5d2a34c05fad2a7c49d9f64d0fbb90d1ef4bcb0929d332b647018e90b33bc6dfcee9006b8a8000eb6dd66133704906aea748b2c8bbd53ab602e11211b44d1
SSDEEP 96:anys8LOd6rFXhGdLGXGMGd0GME8GFGooLfENKgCF0ET08uGHGEgGXj:anys6Od6rFRSkTp08g+LfENdCF0ETFuA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 505c8d414835ad287bb79b594d1603b4789c90942286726c40a6ff0afa7f326e
MD5 32bdd6b6dad9bf2657f9de948142688a
SHA1 59d6c210329caa5676bf975c1c89cba95510de90
SHA512 336a46706334474a2e1d2569c6f4d60216af4dc41cc391dc9a9820693bb25670424d84c7e8063b2671b03d6e47ca89d1afb6c0dc448f61927bbd2176f0c9936d
SSDEEP 192:n2kzkAWGWMBl+lwlMl2lpl4lXl7lAl9lllPlClY2l8l3lhlEr5lTlzlsl2/6rg:n2ZAnWo8yysbKBl+H3hgu2+RHur55Nis
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3440bd036106f8e1ca9f27dc151781070bf3927b8ada5739c2471f751a68aaa8
MD5 ea6a2656bc6f70399d11fcd02cb20019
SHA1 d53eaa9117809cf4ce8742772122035ae7c5e3dd
SHA512 604b1a0e42a7787d78826017069edae33677aabf9b8f9b0764811845fc23f6bba50424a1fd3d69c09c2fd1ad376ca535c2c3dd433100abc872023d48a80b1cd6
SSDEEP 96:n2kz2i16ITtwpvWMoiVmdeHTbZgUWQyV+VD7ziEwb:n2kzhAWGWMX/6rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 28608cfd6e4d9598b3a8cd434d9388c94eab4ddebcc7268f8bea4960d02ff519
MD5 0a0f1cd83d93643c4006a1dd7a9a72d6
SHA1 f9cf90d06a667bf0261275965a483d7d0263271c
SHA512 bade9fe0ed63f7870d72ebac4f8df8c48a6b8cf161ea94439f332250575eed12577bc4783ec0dbabd6ba6951580633fadebbd383d933b4966282410c8a0bcd7e
SSDEEP 192:n2kzkAGGWMBl+lwlMl2lpl4lXl7lAl9lSlllPlClY2l8l3lhlBlEr5lilTlzltlC:n2ZAXWo8yysbKBl+H83hgu2+RHLur5A8
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 89967dfde5b90e5b949d8ecf7bee91ead8cf5c330cb189f3af6982531f2b7f1a
MD5 1e19156994850b554f00ff473cb18659
SHA1 aa056aceb01575869559a8412d671acb54715d9f
SHA512 f8b4e22679dee79783c9b0ae9abcb208c287737b390507f6a13a4016e96bac487f870160c39f197ccef17c82934863f8ed37ee94401a0a3eed36b4978746dcfb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe589035.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589035.TMP
Size 872B
SHA256 bfa1cbefafeae51d091342410376fc9b4413bb47b0d264416657e7864a60ba5b
MD5 d79b7d541c41a096dcc0dc70bde985f2
SHA1 69296e7bce91e1eb5dc6cdb2c7e47c7916fd736a
SHA512 d9ea29878e1005148dc7ed40ada6e0dcc401ab0a88bff8117d782582ecae3cd924b420d159b79b6a64fc52005bea090f97ac9506b8f7e218d45dd35020ce372d
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 addd1b3c09562e3e220d6f57d59ddbbc492db9a9486ee306e648c9c3d6303232
MD5 729fdcc136f358f8b95561705cc7fd77
SHA1 972d6fadbd4b6d87c176f981f78fefc3ebf77520
SHA512 725d45e93c43fc428d8774f9e3b61895703aff781a1d6a8cdac4d136f730cf356204ae30bdc2e01e8263f3af0158e6e6257420a9cb6c411fec2caf4ce4cb9702
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupU1e2RUekkjOOO72MmO/vY:A9iIxuERzA83h09RZxYUxPFOQMZ/A
MD5 SHA1 SHA512 SSDEEP

Submit Download