9bbe012b6d62125caab0752e866c0e867cefd192c0576cb426a73caab2ee947b

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 08:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16b96c85fb4f6404efe75725c69c52fb_JaffaCakes118.html
Size 281KB
Sample240505-jwp3aseh95
SHA256 9bbe012b6d62125caab0752e866c0e867cefd192c0576cb426a73caab2ee947b
MD5 16b96c85fb4f6404efe75725c69c52fb
SHA1 7a2ef1f0e41883a70b973f704b6765f9589275ed
SHA512 a7dfb037803aa060e0c19c122ed48b54961430a74859f5696e61b2ec6a7c88622215f9818bac8b017147c2ba5ec2a46478cb121d5e206f5e61c781fea7f28725
SSDEEP 3072:wLW6WCiqYxDNvG8rmgcXmNRSz77Ler71BMn3/rBmG7khlr4c7RJvfy3LYw3L:JDAXmNRg9xl
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2168	msedge.exe
2168	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4584	2168	msedge.exe	85
PID 2168 wrote to memory of 4584	2168	msedge.exe	85
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 640	2168	msedge.exe	86
PID 2168 wrote to memory of 2868	2168	msedge.exe	87
PID 2168 wrote to memory of 2868	2168	msedge.exe	87
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88
PID 2168 wrote to memory of 1532	2168	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\16b96c85fb4f6404efe75725c69c52fb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee9846f8,0x7fffee984708,0x7fffee984718
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,10017856983232956433,8896460436714764045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b
MD5 62c02dda2bf22d702a9b3a1c547c5f6a
SHA1 8f42966df96bd2e8c1f6b31b37c9a19beb6394d6
SHA512 a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
MD5 850f27f857369bf7fe83c613d2ec35cb
SHA1 7677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA512 7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 20KB
SHA256 a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47
MD5 397383c90a2d930f866f405747e27466
SHA1 7bb6b5d6cee104c877dc5c3462f61232ffe5b360
SHA512 4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoKQP:kBF+i/PvVIOSVi8vSmzXjoQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 652d600f449aca706d089574a0500ae4ae7b33f4d2eae424ce179d57eef92881
MD5 4f681987e52666e330831404cce2575a
SHA1 314767f34905c0794303f8f98a479019dcbe80e7
SHA512 a81793182cc282e2925f544068578f6a3a14455725bf1bbd15876e3bb8f4b1a9a1ef056c8cb915d43c5f40e343456b7d7218c028cdd684463756ccf1a2ee469b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 307c63e8642e2a15bc990a1ef61982125e7311a1afb58c5830f66cba74eafd5b
MD5 bec9435da0a85ba42349509d950b988c
SHA1 937e35d76be02ebfe0c6704d863a7b9bf65b1cdb
SHA512 43e6ee12de58ae3afa4072245fe7dd80c949ec5b64eac281b08fdd34b5e7e9f1d41fb3c5ced3af0d544c0cf615666aa8db4f14d4570311429a87d37bb2f61b54
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 25c0af822b3fb20413171577028eefc8cd957031b2a2287cf244e3dc623f1573
MD5 3b004dce3046073a18ad7126da26f435
SHA1 a82b650ea849b197556e106080d3a2892cf2cb8e
SHA512 725769c465c247dffd37d152b964a815bcfe91b3781d037956eebfdee22269b4f88ba5b91f8e52d4dbf3da96320efcc586764369806274d542d2e0a22d65d790
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 a492d245c4154d0af6c9443dfd41420b544aa843b6113c076c340ee62519f392
MD5 c6e39ec3b1a5014827649e15b59f0ee5
SHA1 99693d0fe4f3916fea25a2ae23f5b67d9a117d29
SHA512 1141a9b12073a3d8d50530781e80a6a3195954fa2708e2822c01096aaf97f39200f97e2871af94d4854542b45586ad63fd15f0526cf1785b72aafbb546118710
SSDEEP 192:npkuDDIfTGWMblwoletlilfGlIMCthlolJREAleXErrAlNlNt492clrg:npfPXWehUg1GtYu9Zrr0XJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 01630438c66e83b86eeb7f7da80d9fbe75b91ae6a079e219778967e3b760d7bd
MD5 ac1592770272939d29abd58003952874
SHA1 dc812a456023acabe63009234e90be044946313c
SHA512 56c0b53a5bc6b633c0d6eed210ee94f05f5e88f910a6282c881cf972a2908205fb6708563515aac2a150c391a8e006876ea33e28fcbdaaa2b5ab7f0144579bf0
SSDEEP 96:npkbt1t+fTwpvWMoiVmdeHqV4lUWQyV+VDCziEwb:npkhT+fTGWMXblro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 9f9c8488bb3252eeaa3f0d1680703bf5c0394e43c66614c3e0d7423708c75608
MD5 68b816f9b49ff13d7e4247ea48685352
SHA1 f3c777f40dcefcca9b624b2deecb747a5e964c93
SHA512 a8df969a2323edeb23da6ecbbc832fb9c0d17f77a2d247a94ccc23320563bd8c7d82063fe681d7e932d1ed92073cd551a1e3682d7f968be2ba5fb4b0449aaf45
SSDEEP 192:npkSTIfTGWMblwoletlilfGlIMChlolREAlXErrAlNlNt492clrV:np3TXWehUg1GtMunZ6r0XM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5f620ba3d794ce4e0c48e9fc998a3603410cfaccf92f3e8595bca52ac2c0f0e6
MD5 f4f1439af5c9f68af22517e5ce3c5765
SHA1 3303cdb1a86641f4cc6dbc207eacdcd331eed7f1
SHA512 5ec4883f5e318b279ea56f4e64dbe0d91a5f6816348ef805cae8e192ec20a8c26e9c823efe7839060d639cfa39a893f7ba5fb7f5477421377a5d2190b947164e
SSDEEP 192:npkST+fTGWMbletlilfGlllolAlNlqblrV:np3TlWeUg1GrueXk
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 867B
SHA256 4a928e87deabda003cf5a058aaf120508d7b2e01e17a3cb1905988f63ed50213
MD5 53772efcb7324899b945408c85f537cf
SHA1 6964440252961f2c121b3b2b8a90e48544dce87d
SHA512 5d8a9c6e6191b8a82b9f6978b6fa07c6711d7b21031e7f9fd37b09a6b3d97d1eb175b94c5412b4e1efec35331adbe6840be39e5d5cc5ef116c98d38440c7a34f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 702B
SHA256 1aeb317151bddf3c5614c5274ffb283599036c98027718531b4351bf21647cbe
MD5 98e1f3ead529c7338eab0f19215df436
SHA1 c1aa74801cb3f960c933982ec9fde5e0a1ef71aa
SHA512 7cd33e4ef7305b2cb71ba46a90061ac2f44cf5828ad84e44a0c03d597e18339e9ed1e95b4b6976d627d06093cc4d1d5cc21c2d350b89851cfa074c31d69e685c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 e5931cddd4eacbf989254b52e5c0210ca086f8a9671766fc6c0bc334a09aab68
MD5 d22a0783e4b1e7431da21163e2365bfa
SHA1 9530e9958bca77c11f89a48f3487578e0c35e585
SHA512 6bf0d903724bfd10aedb54e1b0e6f780d739ae5ee8cfc4051d8e172c80e6548b85e06688f220487765c001685fc964fcb0665b86427a1502ed27608dbff9c45e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cb10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cb10.TMP
Size 371B
SHA256 fd447a4cb835ef69faee05637e83fdefb2df312052b7d18cd7490b6a5e1078bd
MD5 4de739931c421ca3c8c66583c1e44a71
SHA1 b1fb1019857d726fdb346ac4d64d962fc7833d36
SHA512 d40e3886c525f90ed7d85ac73aaca0723c4c0c41ce1afc787dafd579d1fe10991c5adae621fceb8c7184c54df320ec1a4dc40d6837bbe0450dc1ed6530592254
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 daa67d7d47fc154ff312a205b913cf10e10c9c6916a4cb4ef527a6cc94836c72
MD5 e204fe81f612a69679f7c266023ed399
SHA1 f66b06e9fa1daef02bc8054a42b14781f0f37cbb
SHA512 1f82694c4740c81f7d5e6551e76000c3ee3316c49ee2c85965cb6d8811074b9967dfa15f33693be048165a723aa1f3d3ab2d4d1fdf8939e42aaf1d745e71f282
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupo8qe2RUFkOEVCXB+OblfBK:A9iIxuERzA83h09RZxYEc3R/XDafEBf2
MD5 SHA1 SHA512 SSDEEP

Submit Download