8d1f697bc3da7bcfb633ed3cb693ec652b36b742f987de3428e5a19d85132093

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a9dd46530d71dd7074224a0341d7f75_JaffaCakes118.html
Size 438KB
Sample240523-mbktmach67
SHA256 8d1f697bc3da7bcfb633ed3cb693ec652b36b742f987de3428e5a19d85132093
MD5 6a9dd46530d71dd7074224a0341d7f75
SHA1 a8fdd8dc549e21b0100533c2190ca67679c7ad42
SHA512 7774aa06dec717ff02fcead385b6348530f765fb1388de908ba33293ec96f66651b7ed6b95858713b646c16c06d5be9aa755932bbd4cf36c1f75bac1b66f8cbf
SSDEEP 3072:PCXfJVAmw6ldQMsCmYsHgrDyqZaOd+J0w3ep77HEBmusTYZ3ltXPt+KrEGT72GrJ:KJcNNI1LbkQJTuDS97ReWcpyIdhNeFRy
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
672	msedge.exe
672	msedge.exe
2980	msedge.exe
2980	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe
912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 3520	2980	msedge.exe	85
PID 2980 wrote to memory of 3520	2980	msedge.exe	85
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 536	2980	msedge.exe	86
PID 2980 wrote to memory of 672	2980	msedge.exe	87
PID 2980 wrote to memory of 672	2980	msedge.exe	87
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88
PID 2980 wrote to memory of 2392	2980	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6a9dd46530d71dd7074224a0341d7f75_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc19cc46f8,0x7ffc19cc4708,0x7ffc19cc4718
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1304284752429458656,12450293641545256831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d
Size 40KB
SHA256 675cd5fdfe3c14504b7af2d1012c921ab0b5af2ab93bf4dfbfe6505cae8b79a9
MD5 5ce7bdeeea547dc5e395554f1de0b179
SHA1 3dba53fa4da7c828a468d17abc09b265b664078a
SHA512 0bf3e39c11cfefbd4de7ec60f2adaacfba14eac0a4bf8e4d2bc80c4cf1e9d173035c068d8488436c4cf9840ae5c7cfccbefddf9d184e60cab78d1043dc3b9c4e
SSDEEP 768:zznaC0S3xL3wn+dljVGT3tOkaSOzWS64CLUulVINZQ9vQMAdS:PnajS3x3wn+XjVGoknOiS6PzlVIEROS
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 bad7f06da36bacb2d1b346ba8ece8a218fdf942cd11b8fc559950ca8df48ef1d
MD5 e19f3a0ac119a04207480bc6522f94f0
SHA1 0f586b146de4b7712baad3a7f9a6f95a02cec2d1
SHA512 9f538370ccd7501ea5e19de6d210d3617f7556ba231a9c270371696905e7bb973d0f8ccc477a02ab1e01efefb85efa2f78a23943f586a42772fdb757b11da7c0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 b233655ec7911cddd8d395266615798acc5dc57d4fc0c0f636b3148506d5971a
MD5 1f754ce8690280110765e3a696caa490
SHA1 6685e515aa71d80666d21bd278ff0be1f9b70baf
SHA512 e72a810681d5fc493cae04fd2d006e58263f32fb8f19bf7db41ca7def4ac57d7ecdce126fb7558a297603ad8b1dedc255fbdcd3491cf24c291522ac04bcae95b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 5d6894854ee2c0b7687239ac2b78850fe8e021631a4f9b22340ee199040b22b3
MD5 fb9f9280114ae08d39728689f99e2fb7
SHA1 fac3a775a505b63c642b78e6bdcf25453a03679a
SHA512 f770c560454045a46c3943bb3c37bd5d77f1dd26360a4b632f2171dbae6f8de943a4c91cb125dfaf50e808dd26840aa65d9f8a1f5370851a73e3fdbf9b980311
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 20b161a76478da9b17271c49d85d04a1628450c3a95a5439e268609ff09359b7
MD5 b8665b34928fdc3cdf7e023f6608d81b
SHA1 77e575b855ef7dc1edc10a1efa7f71ec5ec4be2f
SHA512 87534165c3aaf3abeea70e39092563720ee3be1ce6c89ae7457fdbc7e473cba4025037e70042b51f9aa82f466ff01e55daf075798284fa1b633080f9519d1aa0
SSDEEP 96:nIkvK1F8juwpvWMoiVmdeHylYcIlhlolZIlElqIl8G4lNl2vSS/UWQyV+VDCAiEc:nIkyf8juGWMX+YDb4a8JSv25rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2835f7e6711e7c6d4dacd2ccd6ba7196066f1fadb3268645a09f83450baeb1af
MD5 37e48d90a17eeaf5a238477f06c431cb
SHA1 e9245548db736e0957e155d228f9009509bae823
SHA512 48734cd69a550fd6b33d921ff0d902ae14bbf5773a9e709236a351b146c65012f28367d9c7ffceb5a1b00aad0beee0bd086b8235d6b06ba359acdf5f2647e05c
SSDEEP 96:nIkkK1F8juwpvWMoiVmdeHvSS/UWQyV+VDCziEwb:nIkzf8juGWMX5ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 240a49b054ae844916555e68b5fae0c5b738881330bd28ac99c043cbe0147747
MD5 52787bada0dc7659f2502e2cebeec345
SHA1 a5240dcf217588fef770b1fb73a0d64db5b0cab0
SHA512 78076e7432da84838a7be7e38d4a9f68fe7367c149c0d211fa76f7b4f938c3afe6e46707db71bfabbe07972b4e2669e30aec41092f3da35f7474d64de5cabdf0
SSDEEP 96:nIkTK1F8juwpvWMoiVmdeHylYcIlhlolZIlLlElqIl8G4lNlGl2vSnK/UWQyV+VV:nIk+f8juGWMX+YDb4ax8JSvK2+8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 d66df6ddc6f59c7b7d2300bc81c428a05c0bb9538dffb9da11f19edc49dfa1b0
MD5 6090f329666233788f495422e8dec667
SHA1 b0b20d259986f92fc45074d64ec0d8401b784978
SHA512 411c38fd790be0571e873d8743dc282407c4a96e10444e5fb59d35f3e94b8baef029da16e812013a4c26c46270300e1720a242550c90a577f4a5fb05d078057b
SSDEEP 96:nIkTK1N8juwpvWMoiVmdeHylYcIlhlolZIlLlElqIl8G4lNlGl2vSnK/UWQyV+VV:nIk+T8juGWMX+YDb4ax8JSvK2+8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 e97bf2d6858c99a8e786f447e2d0c041a1f3d17ad9aff57bab0c8f69597781d9
MD5 f84f4c7023d928870a3f37c62f688a7b
SHA1 8e2cacb982e31d47f897869388c76ff3bdb14c4b
SHA512 7361f326ba8c2531e27864323725e3a9d6ab8b696911a9920b779a180a997c3c9514ac043490faded2442bcb4a7fbb0d287dbb45cc0c80b7dfbd138ec32e693c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 f77f15f43fcd282a9a1f7a4435beeae3b2d975650074b5d3bcdd5903ab34518e
MD5 ee7572cf813ee871c1e91d9e9652bf43
SHA1 a0d16ba06258fe58fc2d709501482f2c862daae8
SHA512 c09d1dac164c7baa04bd8b4aeea5eb55e13207863ec33cae387cadcbc2c6336b745004204860bd7617e25ebcc55aae8d2c7d421c145b73567c56d38bfe373c04
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 1621c37fde4674fa39ca294a581b81a4a7a9a7de8a486632d3153acf7ac62ecb
MD5 9775015ea3bbd340e6573eeb460bc6b8
SHA1 eed11a6c8d7e16c8699d1196b3b59c388d76188d
SHA512 364473e8aa37c86d18f71b27817327a2d0084c8bab942df174793b88da0cafd553d6d930244cf3019dbf597677e4f6122b025ead04c6836490fae2794d77bfcc
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 fb687269e7b67e1951fe95c86521be03d09c50e4bb5076389bbbe63a4b1b5a61
MD5 ad68e2853ee4d664f7f59c3c8415df95
SHA1 378ebbfbbe43b6337254e6d5cf17ab726e19a926
SHA512 a0ce003e05a9b96bafccc77bb66b4dcd182ff6ab7431994b9a662ddf75db5288279e44c5e4b9c0271ef364707b0ce9b76116f090b6c9bcea99a4e253e6eba764
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 fa70d7fead0ba448248d8e0155ee3edab4ac0496f7c32bbd3293b81c9c7e381b
MD5 669b402f11b0985c533a60fe5f81eb20
SHA1 d61b443871aeb8e2cbb0cd8b3c0c6532daf25ed3
SHA512 a7015923d51d97d36c016cb02ccf5b5f10dba01112951fdf9117b17a3c98d53b50e100de64511921e0f82bec62e46313f90e09a8f29ebf7b562ec746505eb849
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 ad36a80667418a10f9063f2c9edd171ac0311fbfbdc34b28b569d072213e4168
MD5 dab8e2b15bb27fab1357184306e2c15a
SHA1 1a2716b1c7a3e8096429b199bc1c970efeee287e
SHA512 c82eb322c97d6113e61af7503c79ff963e0b5d3d23307ceb4f7c14c8d5fb78cb4a3464780835ba452110075d3d73bb87b4f85b4db2c8b143e221706ad0ee32ca
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ae41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ae41.TMP
Size 537B
SHA256 1d596f1fa974935c1697325cf9e0f499adc9ddecc1e12d14969f5ae4ab68dc69
MD5 604790c79667ebf974add92b6d034136
SHA1 5bf7238efb11aec6cd6f9e24c4f99275bc18a45f
SHA512 f6f0f485cbc287a38f04b6c8aacdeb9ca7d7874de06dc102cbe08edd9b2ad25074fe1d71cd30d7682527b3c6558d225eb0c6fdc48072f73cfc2722fe65dd3734
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

af4c4be7-7337-4487-a923-efc87b37567e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\af4c4be7-7337-4487-a923-efc87b37567e.tmp
Size 11KB
SHA256 339eb2ebf32f92c73c31f845d71c51108f305bced0706ffa2f5ceba06550a87c
MD5 89bed89646644dd395888a6687bda7c3
SHA1 fa9a95de351bea30f7f05742f96c474da64481af
SHA512 434f58a27c8ac5226744f6756725ff3318d7e83f5a8d80cb930f771627dc84d8bb73eff98104af79705ba9d6c49584802c06052967579a3f5312fff0e6ea6d48
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTge2RUI/RuO3z2OMDCRHq1:A9iIxuERzA83h09RZxYT+dMOaOMWRHq1
MD5 SHA1 SHA512 SSDEEP

Submit Download