1591b6de40a393276b3e2d1338e5bab3b4d8f5f3e01899f48751003b7a6137c9

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24dc540e2dcafaba8a4ae62b7aaf71e9_JaffaCakes118.html
Size 367KB
Sample240508-prqqxsfc68
SHA256 1591b6de40a393276b3e2d1338e5bab3b4d8f5f3e01899f48751003b7a6137c9
MD5 24dc540e2dcafaba8a4ae62b7aaf71e9
SHA1 feb4efb7e7edd1fa80ad2ab5f15f9153b2c274bd
SHA512 54ea7d050ebc640272db5012f140c0533e9991aad35336733615a51da1db291ed113cf6bc21427069653145b68ef192eac00c0bec850c8f4f2187dec15cb94fd
SSDEEP 3072:wsW6WCiqYxDNvG8rmgcXmNRSz7nLer71BMn3/yBmGSMF4Vln+Qfz5wjVrn7RJvfS:gDAXmNRc8oMF4Vln+Q+oj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1956	msedge.exe
1956	msedge.exe
1004	msedge.exe
1004	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
876	identity_helper.exe
876	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 3492	1004	msedge.exe	85
PID 1004 wrote to memory of 3492	1004	msedge.exe	85
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 3708	1004	msedge.exe	86
PID 1004 wrote to memory of 1956	1004	msedge.exe	87
PID 1004 wrote to memory of 1956	1004	msedge.exe	87
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88
PID 1004 wrote to memory of 4896	1004	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24dc540e2dcafaba8a4ae62b7aaf71e9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc923546f8,0x7ffc92354708,0x7ffc92354718
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,1184143337175308050,7180237574380073634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
Size 20KB
SHA256 a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47
MD5 397383c90a2d930f866f405747e27466
SHA1 7bb6b5d6cee104c877dc5c3462f61232ffe5b360
SHA512 4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoKQP:kBF+i/PvVIOSVi8vSmzXjoQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000020

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e6c042d7b080bdc16ae80d8abdc36a660018ed2dbcd06e121a4838a433bd6d42
MD5 b282c71312d77d1d3513e98d813f7ee7
SHA1 89de1441b38d1f7af079ed860b435bb3114c6b4c
SHA512 1810c34ca44ec358e603fc6931ff076669ace0d08e63e2761e793701b1c653710215eb9e61c916445d21cac042b862545af3344924b9a885146ad4594f4f51de
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 466faaa94683f64f8a7a9d82e1ac5cd266ec6ed57d5ea38655b334803f76214b
MD5 29fe6099eeeddc22b40647fa47be9e4d
SHA1 943607c64f7fbd3a3f0cacdce5254f76b93c9120
SHA512 26533f64ef79939a4278034b24b3456b9d282bb49dd187bd1b44b39ecf9359b8b3da971a5159c8e17ea83c4d2a2910e5cde4ecd4a254c0ba2505c264f41fa875
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b34db8dc14976d89a2cbb6cf94589d54656f571a1fa7c81ca467e3a62c67b9ab
MD5 4d2283953a12e5f856597cd26565ec82
SHA1 362246b31d2aa1d37dbb6c245084e4ecd2b28fa2
SHA512 9acb00b5c7acf3086f478257fbe486fb1f3f799e84f49f31f7b0caeffcf3598f214a3a5654a9e016fd035fba9c5381b99ee16a14bf6a3d65b2fc0c7d2a8ad474
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 81bef112578a00a7ae7cf6a33e02f69fe26bb7ebb9b3a2bbbb3c672873c4d733
MD5 5a1b182fdd9b91d6917eaf69d272ceb9
SHA1 af891af61c16c1a65d21859ba9284fa33a4c2147
SHA512 d8bec58962846056a8aa749696046b8bd4ac5662df1df31a76d00bfd3848323a03275c9db6063d59ca50048d35a6ca32d17c2e4f71a8d4d5be958c04462eeece
SSDEEP 192:n8k5LnkGWMpAeJ0fiHMPSgR9IWErP/GdHBY2bkrV:n8sLnRWnbBmraU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 5625c7842adb47d3d54f86000f917d5008cd00d927961e5cd33979c5ff8a8640
MD5 476eec3bdb261d3bc03789c5a96d78e5
SHA1 a278a80d5d89caf9bbcbd5663a19d220798ac6ad
SHA512 c1807a028b76e8a77ad8752c1499305e74437b132997d5eac549b74c84377ebb1488d6165a2e14415ba69f9a3695452fe01713a2a8f1e56a41b4575e39aaa0c9
SSDEEP 192:n8k53nkGWMpAeJ0fiHMPoSguR9IWErP/GdHBY2bkrg:n8g3nRWnblmraR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 88f6fd6721c80e01d13b7e59250f6d734085c9814d36200a317205baa34e20f0
MD5 f4cd481179624d10ddba9023253bfc79
SHA1 d09898444ecfbf65e6c2d5ca3b21fbcd618c5f75
SHA512 fa806280f3124eec906f4f5f5a83c76167e93b1e3b7e467d6e58c288bab4a1096409500a6c076d0d0c5a5bee4f0be8b5d10ca6a796b6452e6830697d09e6b1ad
SSDEEP 96:n8kNPI1XxuniK1wpvWMoiVmdeHdt7OUWQyV+VDCziEwb:n8keLBkGWMXbCro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a17c296ce8424fe098653c8ce6aed96962545f2a7f0d24b4ab7b422c8f31a104
MD5 b56428720a93e4bdae09d96f6d0650c6
SHA1 b8f1c54463452e1e8fcca04527d4c406c4f733e9
SHA512 f310dcb20f91ac90ab393c8b9ddd2502ad952febd5a153431ff17a254e6e86e42accd5cf6f174a6c31af3b7e33027efca3b1fe874ad67b920e0eec58b6b12aee
SSDEEP 96:n8kIPI1XxuniK1wpvWMoiVmdeZeJ0fiGg/8Gsqdt7OUWQyV+VDCAiEwb:n8k5LBkGWMpeJ0fiGg/GqbCrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 778b44344b26852ac24255bf883331a6525456ea3e6acc5e274c0203bdc290b5
MD5 7ddee9d6390095239326495729fbf50d
SHA1 c3e5bcd0d2bd0173ebc6e10f84ef78eb11b31a3c
SHA512 c2508be005c1f3f8751cbf07bff0ca2170a9c8cd0d790fe32b94272a0555995553e1ec1043c22bfb15198b881bf030b5ab1c6d2eb7ad9d113fd620491418427a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 ec6cf18773732e60cca4f1224507f54d827f1ffca0b04ea9af5c4ab63ec590c4
MD5 da481517c796bd90947403cb06ecd680
SHA1 b63ab804f96175333eef0aac37d9840d67c3f140
SHA512 87248d59e47c695180a75ea1bfc3759a2dbbc01fac5dd4c9e1df654f894ab5771064406bbf458c69ea68b9a52ba055f48a657d0799d9138d0232c3b805024674
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 cf157fe4bfed71067e4384e999a207d0e579605ed2d82ca719c6f5df8784c893
MD5 50710ae8a4c902fdc3a8895ca5762d7a
SHA1 4c81ab763bc3dff56d031793d56e9cd0f3c40ca3
SHA512 25d015291648fe0e0a566d47701f9352818124c543ad6583d456381fd7013c83e3dc6356738fd09858c2a01d128cd41eb3bb21e6c3846534764d785bf4b6b794
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c6da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c6da.TMP
Size 371B
SHA256 136208f93a612442cfdba7fff40cd4b8112e6773d6ec3f0d6aa340114b394f73
MD5 c468d768496edfd97c105fa29de3fcbe
SHA1 16970b3732b70084c73e11577933a1acfe0e3810
SHA512 d9d517e9ffd74fe3049f4f688853d5e0a2ae8cad5a4136af24db28255ab709fd1decbcdf904d8f827cb801b3c8c004c2e219622fe165c2096962bf2c05e184e2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 18226b4d6ef0ee5be95166629e4ada66e085dfad5ecaf70f15584133df79e4d1
MD5 ebcbacbbb300caf026973d630b9b87a7
SHA1 91e4efb5460dc03fb9ad69f6004b2d1a9458e23b
SHA512 f95075e9ca42b249a60ad60b323b812e4e5060cda17532ed6e9ea5e2c27e91517dd340e988b45f11626544f7b3fd47699e606a5ddb5685c51b5aa4a13a99a076
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupbBc+e2RUG/Oie+OblfBhDA:A9iIxuERzA83h09RZxYxvZe/XDafEBMd
MD5 SHA1 SHA512 SSDEEP

Submit Download