02fd764bcc27d7bd1edbc45dea3d49ceefc699030dd3dfcff9a6ad491262b26f

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cd839a6854cfe38efff059b742e754f_JaffaCakes118.html
Size 205KB
Sample240506-rc3s2sha28
SHA256 02fd764bcc27d7bd1edbc45dea3d49ceefc699030dd3dfcff9a6ad491262b26f
MD5 1cd839a6854cfe38efff059b742e754f
SHA1 fd5e2c577cb881ab79f58dd79d62f26eaca69203
SHA512 802b3db7dfbfea81a9c4062ec0726cedaecd141d07d12e70e99e7a82bad64b9f3520017e37dc716fc88e2c105112432311464130f141c01d2b2bf7b90fd50fbd
SSDEEP 3072:JGqG5bnIKY65h65h65h65h65h65h65h65h65h65h65h656nWwIAlPwwyezhPdB7:snmAlt
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
4604	msedge.exe
4604	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe
3844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 3600	4604	msedge.exe	83
PID 4604 wrote to memory of 3600	4604	msedge.exe	83
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 4060	4604	msedge.exe	84
PID 4604 wrote to memory of 5076	4604	msedge.exe	85
PID 4604 wrote to memory of 5076	4604	msedge.exe	85
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86
PID 4604 wrote to memory of 1868	4604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1cd839a6854cfe38efff059b742e754f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801b46f8,0x7ffc801b4708,0x7ffc801b4718
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1432 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11308052942544232156,16096556129900237314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 21f5feff7c5c2578be7ce6b804eed80f30a129e8dfea939d5120c5cb47064fbc
MD5 64f2f3863bb4e59d17fb6091feb0279d
SHA1 099b32354df0a4c434974e87eaa51de89851abe3
SHA512 69eafb46744a757636ee3a28bca841ac4529d9342920fee0849ed8e71f5f52ba86d7334d721806d516305aa2e3989d8f97e34876fb75c8c8735fb0cf7979b3fa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b1ded54e37660237e68b975769fa7443fff4d207d73a74d13ac53f0ef65b5578
MD5 476884ed170de322fe7b914501c5a152
SHA1 b9a5edc3e9793263e1372bb9eeab09b8fd6480be
SHA512 11c5b825a6b90f8ef80a04dd6ba2577c65835369d24dbae27dd33a81842be77df08c2a3a1afdb5428d063a30a2cb07d511b20aee38ffd0ed6611ca8db4ef3f64
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 da5417a3268cc13123d1fd724c18352d48fa756486da04357a581bf18b766063
MD5 6004a9e24f03877b4ca62870873d741d
SHA1 d50c558faf730ed39653ece8c168b6496b128d88
SHA512 2f7bb6d84b71a442eb0ef265c4bdbab0dda4e90356b178dcb7a32b6b7c20bce3547fde668afd0ec8fd3dc613828b844e8ac258ff1bb5b74152e0642e2191d539
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 0b7226a40d13c5c3c8c8140ffa8859e0c0f9b326a9ee6df348d6996a53d800fb
MD5 aec7c405aedd4760ad2b371a49e8baab
SHA1 7b065a83dbdb315c7130f902fd87141e617cb513
SHA512 b4e2d6cbda78f5d2230d736aa1c6939dc67f1efdaab3e0297364a347e788d313b459e72ba56f8f62a20d9422c5650779adf5c5845315f1900c948216fc8b2fbb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cb36b6b95e5c2f87c5cd5c62d3cd845cf782ef37afdf79828a09c6f5868d4d83
MD5 306351b670b8ebeabd45051ffa2f1a2f
SHA1 581c01ff4a4cdb28b711c362d6cc304b3823d87c
SHA512 3137d408ad8b2574e2f5bc260762854a7c21b88553bcd0fd44a96db0924339fc0da70893d9b3ba2eaabf3d0b20a103ad9ae6f28a217079a778b2e2cca1fdb3a7
SSDEEP 96:ns2kIxm/eQYmqU1p673wpvWMoiVmdeHplwtHac4+UWQyV+VDCziEwb:nXkpHnD6jGWMXp2X4+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f02cf90be2ada0e3daad808716a390dd56eb40b9209c2cd96a310c63b839a332
MD5 8fd4aaf3e751472a9ecbbc89ce0d154a
SHA1 1420a9a9a3b683dcb0d6ec2e4ab7e77f557750f7
SHA512 3f3158c0e350ce2b73fe3113fc81970c40ac32f6d35e968564e9a546865218ad3fbce8a041dad1b6764233379db32fa440103c780b0dbfba6cece62e740b347a
SSDEEP 192:nXkpZnD6TGWMOdgN0SGqs94V12p2X4+rV:nXQOCWU46
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6edd22b5e22ecaf9b67523f19ce9892cda9ec09ed459c4d169ee83f9b43e5b2d
MD5 f622f715143561fa646d2f059abfc970
SHA1 33f7f6a0e770e1ad62ec0bd00319b6ab63380841
SHA512 e3ea2f4441768f9ddf19d9349e51b2ee048f4facfc9250a4014f0b6013b669ca04ae28005b5369c756d8c5eceab5efc9482bb1e8bc71eb9f5ccc8b054259a749
SSDEEP 96:ns2kIxm/enmqU1p673wpvWMoiVmde+dN+ZSY2plwtHac4+UWQyV+VDCAiEwb:nXkpZnD6jGWMOdN0SY2p2X4+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 69dabf1bb1f22df0a00d4fbbac7941020f1416b63e3994755a05800c95e37e39
MD5 36f3b0c3185b20e071ee7f06f9083dea
SHA1 30c4f22767be93e9e97405326269aedc67230601
SHA512 0d991000b468724d6e2dbaeba3d6fcf59d0e593474b1ef4aede8057056f82d91bc06263eb1a662ebd95410422c53b9ce28dbbf10eed20806f6a9fe334113aa36
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581836.TMP
Size 204B
SHA256 d6fd8e28309350fc1cb07768c3b2ff80c651a11b3b6dc7427be22e999c244722
MD5 8aed66707a2a47001a586a1064c9ea6c
SHA1 2bc0fd41744db6c3733d5b36f2a8e54ba56f306c
SHA512 eb96b0ea036e51bbdd5b9eb8d5be563dca47a8c9c33f0348ef322f0e800206cfa39243b360a8a806d855dfac704b6a7b30b706cb6e73489cf4f329e286ce9691
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c48a62211b942746c892ffa4f7b68a0d32a734f53ef6a7cce1c4c42381581068
MD5 1180028974ea855852c76b244f77f5de
SHA1 20b26fea7555c5d425887c775c7a6d7941b47a47
SHA512 5aca12e612fd1957e2fc591a997ec76dc3c54a3b37b2384b4a4363edbb572e0683ffe620fd4b82247345379e23cc1a7d8a9dd50651584c0c9ca578a3b6e4094c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnjAe2RUv2ZO+OblfBhDaa+:A9iIxuERzA83h09RZxYnKPO/XDafEBcx
MD5 SHA1 SHA512 SSDEEP

Submit Download