33d786e8031f212ac6316a0690890fb92b8297c1561e64484ca4f895e3e36730

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/05/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c572a15ea31c659166270736bfd69a9_JaffaCakes118.html
Size 1016KB
Sample240501-vjfhwadh85
SHA256 33d786e8031f212ac6316a0690890fb92b8297c1561e64484ca4f895e3e36730
MD5 0c572a15ea31c659166270736bfd69a9
SHA1 ee678f1432d9eb53076eec387654371a8aa66c11
SHA512 8750d3d66fc0cff93a52674256f8f42ef69c9f5ab4adb49a8deed724e2d9ea4005044b09bf75c04e71217cf77b88377899848b189455056fdb31630ca477479e
SSDEEP 3072:HmZKc63mGtbfpWm0xopE3m51qauvZIOgq6pavaBNlH:b
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
3224	msedge.exe
3224	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4016	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1492	3224	msedge.exe	82
PID 3224 wrote to memory of 1492	3224	msedge.exe	82
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 2508	3224	msedge.exe	83
PID 3224 wrote to memory of 628	3224	msedge.exe	84
PID 3224 wrote to memory of 628	3224	msedge.exe	84
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85
PID 3224 wrote to memory of 1140	3224	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0c572a15ea31c659166270736bfd69a9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab1d546f8,0x7ffab1d54708,0x7ffab1d54718
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2744 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1994992762651908540,1525664317322388469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3176

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414 0x384
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 82ac9e8d84a041a8a09dc5db838726dd103ac93411709d9fd19e3ade7eedd4f1
MD5 c22191be197b3ed54a136b511f454d78
SHA1 6acf5a7919a2afe0f06c66128e74bea04a656974
SHA512 2ca0d4f769b65e0743d800ed2ca3eb0d513827ba86fb8bd6819d4b593abb52e8c11cd16973766fa5a30178c160ed67a2a85afeb98e625851ea353d167447f4d5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ba296b392acfd135d50fb883bc8a23b63e6466c35240b5c3502a08da47bc9151
MD5 9608edfe2ad935dddc1fb4db667e13e4
SHA1 9dbf4a585125a7fd5551cce2cefda9abdf6c5687
SHA512 fc29572e6d47464d3570ade60f8e5f0982106eb817c1f5d1969e7315ae80171ec0de53ad35f476dbc6bd17260188c9fd39fbb6f0d168055b5c3e326989f7734b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 9a0ca1a47cc147cc6626d96e08fe6fd1b054c22a3351b582ce4ff06d5e56685f
MD5 82a131b47cad079789e8291809b1811b
SHA1 2eb87d25325eec07cfa7627591c6204f3bb11755
SHA512 367dd5bd6eb080f726ae27b71a90a86c6f29005606f56d90530394fd28e17260fb49a0f61a86a5e19bdbd6f581e9f06b1c8c52f7483c33da40ca8b448325dc3f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 782cfaa9cd74fa8ac5adb07a687bf9f02eb8d41f4c791dfce6978fc4d4c9af80
MD5 83a9e5b2152a70e9aa2a0a05856360b0
SHA1 5c37663c5ba7634a8535e0a160c77a7ddb36bb47
SHA512 2721b215831ae6d6d84ae3035e06006f4a6e021671ad21b30129035913dd2f60b0136f023f08313db9275bd1e43feaf086b9a7b348a827f07b97bdb0330136bf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 32b19e187a6c85b9e367d39c78f47ef94961509c73378a3882b3d526eafe0d98
MD5 e6522d3282e88a4f2f3907504946ba8e
SHA1 d9991e3f9caefa2d52855c0c4a73b33bb45be018
SHA512 c0e6c4cb472e42c2a22a30a7e452e5fccb99ae0bec0681fa70d68d08459a687d590c271881ae4dee6d99e49737774c2d6286caec6aca79f3fee96ae301002c88
SSDEEP 96:noFkU4014pwpvWMoiVmdeHm0KtUWQyV+VDCziEwb:noFkL0ipGWMXero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cc4a82d4d697e51f8e9d81fbb0385fe9f9a1c4e64ffdba28050ba36b92a91aa4
MD5 ab47799eb97ac7ffd429f3ae96e6e02f
SHA1 d1067ac06d40d76fc6c62be0078c8e21315b1471
SHA512 6c144a5f1531230628dc475fdbf2d3f33a5b620ea107eef816f12827b73c25a56dafc8ad1d014bbeb58adbceb12544702417a79814fc8321e7b580bb55ef4bde
SSDEEP 96:noFk44014ZwpvWMoiVmdevt+eP7IrZ0ZlvHnfRwN2m5KtUWQyV+VDCAiEwb:noFkv0iZGWM/AeP8rZ0ZlvHfRwN2RrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a106d7e4abaeb93f7b00e8694c790586f82779b0743eb4bd8e78f137b1cf7261
MD5 303805173d03f6838b078ffa61b2ea4a
SHA1 19808965ee50b1a4afaa45a61417ac3ddb4490cb
SHA512 d2e156e34bad3828298a8ad98cd9e542c530b0ad5d030a5f1547f7db1d0fc525ec3b823b8ad9f28db902146553f047c1ee1c9906e5d3bc8a9068116809033f89
SSDEEP 96:noFk44014pwpvWMoiVmdevt+ePlhw2m0KtUWQyV+VDCAiEwb:noFkv0ipGWM/AePlhw2erV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe58d9b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d9b1.TMP
Size 203B
SHA256 d047fdb7c80ac18a9434874285312ab643deb3fdded2ea1ee437619d133cdce2
MD5 c1f89a0aabdc66459cbea52ee3879047
SHA1 454cba80a2064e38a3479d4128330d33a3e6aa80
SHA512 17e753c9ce0f37b556b2adb1895dd8b133721af95355d46d4e223e9e412b776dfc93712071219f8d8a2f6a7fc853017ec183bcf5297689735f2c504bcab6f907
MD5 SHA1 SHA512

Submit Download

b4fe5c9a-6c3f-4c02-80ed-7c95160f52c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b4fe5c9a-6c3f-4c02-80ed-7c95160f52c2.tmp
Size 371B
SHA256 0985a47e02e1f005207e66151762f09982ff31c7b5f70446946f97af61e77346
MD5 9a15b5d0ad098cbdcaaec9e1f185673f
SHA1 5ee42f723a5a3bdad5eff7d57e50173f6a1abfee
SHA512 9c86fd259fcaaa368186a557c424da6756f7e3f0b006295c67e1aada437f951326d2b88a58f4d904c89a537db26551b2992e9b9068a974848834347121300318
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e724842ced45d2b63cb3624ad15f0399f6566066d95bf2d479874128933d259b
MD5 b9ac4083e285bd58a74045e303c7f318
SHA1 f491b7cb09fa62af095061eecb2fd542136dd326
SHA512 eb7692a3eb773f2104e65a983498da9254994e8c665e4472918b9f675e2ed1c8576513306dda45c3351f9014755f6acdcba0678f7b1c2900abef60995893cdb7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup/Te2RUSxhXz8+OblfBhDau:A9iIxuERzA83h09RZxYLjF8/XDafEBNj
MD5 SHA1 SHA512 SSDEEP

Submit Download