25ae2fab32f8eee3728dc724acdd365a72bbc6f2ea1d74f572c85973f00782dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
157827c8e8e5054a26eee9f39633489b_JaffaCakes118.html
Size 122KB
Sample240505-cemsaaba9t
SHA256 25ae2fab32f8eee3728dc724acdd365a72bbc6f2ea1d74f572c85973f00782dd
MD5 157827c8e8e5054a26eee9f39633489b
SHA1 65795868dcbd1d90656d4e2d869237d25e05b304
SHA512 b2645f96ccb06d67cab15c44d5ecc0958433f88d50c493ef8039ede7955709ea594cd117de94ed6bc3e38b54bb94597a072387f36ffa31b3d15c7e91ecb617e8
SSDEEP 3072:C7Th/1/tHY3+t8aNI07yvHKguoN6gajZHtBeNNh:k/THY3+t8aNI0K
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1736	msedge.exe
1736	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1972	1736	msedge.exe	84
PID 1736 wrote to memory of 1972	1736	msedge.exe	84
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 3780	1736	msedge.exe	85
PID 1736 wrote to memory of 1944	1736	msedge.exe	86
PID 1736 wrote to memory of 1944	1736	msedge.exe	86
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87
PID 1736 wrote to memory of 3244	1736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\157827c8e8e5054a26eee9f39633489b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6d5646f8,0x7ffa6d564708,0x7ffa6d564718
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7854479039742866197,15363346053796917162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1752 /prefetch:1
  2⤵
  PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
MD5 8b2290ca03b4ca5fe52d82550c7e7d69
SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
MD5 919c29d42fb6034fee2f5de14d573c63
SHA1 24a2e1042347b3853344157239bde3ed699047a8
SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
MD5 SHA1 SHA512

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 d97aa7e1b2620d1a3c7f3018259110a846b06ec313797c9a5fe6736b29d85f99
MD5 368c5cc659a249b18d597795f1e2bdd4
SHA1 ffa212779b81f6fd0db172af819d8d1ff592a4f2
SHA512 3301b7b14f906e0b65a326526df4a58242f1d0e024ce9320d6527994dfbc75aa8d30e82b2602cbcc0890700fc57ef410a49df61758076f15a6881492ba7c1390
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 e0c9cb9c29d70c305be3c055cc85fb636ec071011957a12d4260b61fcee1f784
MD5 f2ff856f62e8a195b368db534319b341
SHA1 dbbd868dc098dd027034b487ea0646ce1dcce247
SHA512 afc4e6fcc01599dc954869b28728694cb67fe793898edbd287929a84f43fe789e260640611401496eaa4262b13e5d06ad4509b917923f47239016ee2ddb3d2ed
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 9d0dea01e087973401d3dea60d227e0cc89acafaf8fc8d4e9556c1d33ff098c5
MD5 5005cc28e9f5f186272baee0140bc574
SHA1 d704ac5db1b3b625541576dc999ee1a81f224031
SHA512 16f2b7a531f6ca6561f4ed620422a7c3505b4339931c9342de54cc0a904ccdbc2250f7d4347342b136fa96767e50b0396e047ede5be292dc6721143a914c4e89
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 02653bad76cafe5b52f196dbd6610f8135a41f945b3a1c41f44db010c54bc9e6
MD5 40885745abe22c8a1a058eec91e4e619
SHA1 c4cde10ae0dbbfd9d47363cd2df26895925bcd59
SHA512 6c6f33859580795d2aa8eee2a930ff3d0cedf9b43e877eed9b6f6af2dae20e8164acc48d887a7f4fe7205e9ea972b5dd3ea306704e275d20b6068374f03782a9
SSDEEP 192:nXOkS9okgGWM0eeVyJn1PaEQOhaN0n6JiaiJp2F87wrg:nXOx9ok9WZr61SLka66saqY871
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 61169c9e26d0f4b14932795b4b9b964446491dcc6659bc1130b935aecfb37251
MD5 b941b64d9b382673f7b5030685f83d10
SHA1 44f7e6c0ed1f406662ef64bb2c7e2a47dc2843c4
SHA512 02e7eddda0c5002d995b85713b5f0b4a02a6168fe180991f7d42eebf5a646900eeb8ce5414d6f99ad57251ffe01d2628f3df3c9527977f70ef1e9705a8f0d23c
SSDEEP 192:nXOk+9okgGWM0eeVyJn1PaEQOhaN0n6JiaiJp2F87wrV:nXOJ9ok9WZr61SLka66saqY87o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8ad0f6981f845f2ae5575918753bcfe41fca9f2cc9a4e77ec1c936e8ccb5650d
MD5 ad6a66396576c7cf84a6f31840e41620
SHA1 121435a9e42a76536c3e7ca4766a0772215476c5
SHA512 68c1b6153beb92f081b28bb1c77f2099362fb6a7afd4a195657e3380ce6f660fc7a6a456fd066be6ba666566f30324a6170d7e292d4b336871dc2d10eb206494
SSDEEP 192:nXOk+9okoGWMdVyJn1PaEQOhaN0nuaiJp2FZ7wrV:nXOJ9oklWG61SLka6uaqYZ7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bd9efed29ad40b05121b7fac954014cfeb2be4504edf38f1ad1f8cc1cccacbff
MD5 9a38632a09f79d75a0b57936020edf9a
SHA1 7bdc96e55b00f6ab609376ce812dc0f97fa099fb
SHA512 b2643e9bcb18716bade9be9d02c23a2f8f5d9e03600e79084ed7a559d1ddb0349e06f04c07568a4c10f14b986a27457e68dddb8daa1bf8317000c13b68a7eeb8
SSDEEP 96:nXOkbn91ekX12wpvWMoiVmdeHuwuy7wUWQyV+VDCziEwb:nXOkj9okoGWMXFZ7wro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 246d7ddf87d8dcd65a90fbb85f492b08494cc50ee9bc01522071ec49d8905c23
MD5 5f1786eb09242c3b7651f77846314f22
SHA1 fccfd1071d56e66b659eb9536a3a0e1a6b4ce963
SHA512 10c4441cc31e971ef5f37f343cb710e0e3cf0feb3c56f67c5953751dffefe28abd4e9e93f303475fda25c868ba26561bc23a6e36677d2019bd5a26b26189f6fb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58c36a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58c36a.TMP
Size 203B
SHA256 ba4c0d69a58702bc70d4e42598a19278ec287db05eb8adfb629697f180633f86
MD5 0075c016439f448cf83a0985d1ad9726
SHA1 93cc743348d13f88772cab335678be908babdcbc
SHA512 bc24219cadd3c644e155c17cb2f0922b80e83212e328a8756bc279730d0184df85ddd51ed552e525c714d8c34cc73cf129bef25d4aed508103ed82f4580d35cd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 68eef5171d96396a13927676fd6fd6d9f56ec2da21ada48965215895083aba6a
MD5 70f9e83cafc8c12e3b46c72b3c4dc0f2
SHA1 c7aff0caa465a3b481005e89e8b16ef6dd430366
SHA512 a9ed5fd37711ec724868c7e3200f1d77e553f554701b2ec6ec57d682273a3c515a31ee95b2c7f1977889ca3c2f0f4abc1b571c0b42a016a4e22ed77ecd8d60cb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup97sJe2RU9aoIzW2+OblfBc:A9iIxuERzA83h09RZxY97sdQaJW2/XDa
MD5 SHA1 SHA512 SSDEEP

Submit Download