edefc8e7f334f682e009598db30f868b95b0c1cbfd3ab2926b924f83dc55b2cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70992b29f9251fbb73e87230a72d6459_JaffaCakes118.html
Size 300KB
Sample240525-c4txwsbh48
SHA256 edefc8e7f334f682e009598db30f868b95b0c1cbfd3ab2926b924f83dc55b2cb
MD5 70992b29f9251fbb73e87230a72d6459
SHA1 739cfa22510f38d3d229ee026f66fff136734bf9
SHA512 2bf5c5b626311ff20f39405116502f2345d9f6b1f9e5973544eac3e04d0ea3ac83044aaa4d50aed79c4c9faea405dd2f654395950d5b78826b04a7e1fa639591
SSDEEP 1536:LD+SbTTF1SjTJMNkltM/jVII3IbIre0dlzmS6oW1JLnvuIAgV0A3o9dE6gF2k/ch:/+SbTTFsMItCVI2/cVcDiTCH
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
3936	msedge.exe
3936	msedge.exe
2504	identity_helper.exe
2504	identity_helper.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1192	3936	msedge.exe	82
PID 3936 wrote to memory of 1192	3936	msedge.exe	82
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2856	3936	msedge.exe	83
PID 3936 wrote to memory of 2480	3936	msedge.exe	84
PID 3936 wrote to memory of 2480	3936	msedge.exe	84
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85
PID 3936 wrote to memory of 1356	3936	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70992b29f9251fbb73e87230a72d6459_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15914687706294670203,15870350956717897187,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 22KB
SHA256 bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105
MD5 5e74c6d871232d6fe5d88711ece1408b
SHA1 1a5d3ac31e833df4c091f14c94a2ecd1c6294875
SHA512 9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5
SSDEEP 384:z5y45znEXC0Kl3/5Lw9MeUrFLMuNrn9GVxEVSYnBvTzlmylDY99v2VQYfoorMEiJ:zznaC0S3xL3KmGLYSKTzlJY99OVQYwAK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 4a15c7e68cb702c014d3d040426d4fa42603b53dff03ce7e2e2b03fb3aebb46f
MD5 06e956ccb19de121f127b56cdfb02424
SHA1 350652568330e0cccd24d474f536880d14c9db00
SHA512 f4c44654db223102b9131aa73142bfc3db1a4b982a8a91d69374cd049c12d9ea68a40acefa5816f45af3f0a51afff059848d1fdf6435d704b9f0c8d1eee79965
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 6ae1298ace21be9166fa20e78839fc63bcf3e2302b2d54afb05b911db178c9fb
MD5 48f1eeae190ae26a7e6b32ef361305d2
SHA1 8729a2fdcc400ceef3166fc339cda7075ae7e339
SHA512 a80d60194417c414a8d313028dee444072b569edd699884a3da0945ef9d095c9f0f3b21cd2801ea02c4890a650ab32c7be911b40fc814c117c85603d45810293
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7ac51e64911b758a3efce9c1753855269dac150e3afddd4447309a380b5d9ddb
MD5 cd24cf93cfd47390d8d7fad141b803de
SHA1 091d972a04e776239791ed42a227e372fcd3e1b7
SHA512 4bfd7ab616efc96cffc28c2bc04605689fdd1f38ece646a6690f5f9b96b35f41cef7c114cc216e97687f91ffd1fe404cdf99a0b3d4402e6f1b7ca256797f84df
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 611219819fd65e1e5c7ade124f293fb1a6a82c92bee991fa71722c4067a53c4f
MD5 366facb84e148a36b9cadbc2a3119f49
SHA1 0eeeecbc2fe6fe727437d456a9739d9adbcdf43e
SHA512 5c44c1bfdae56b9d0db0c20d93b4975b3e0baaeb699f8f7b9a66b71029810faff6ebce4a7b833239728420f7e54424c70cbc317e4de0b60d023ee46a756ec528
SSDEEP 96:n2hkJGt1b4juwpvWMoiVmdeY2vSSv33UWQyV+VDCAiEwb:n2hkwt14juGWMo2d33rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 14f007232744abcb10936a34bcdef98cc70236102ddf389d1df985b69d41a9ea
MD5 b1dde03f1c5f095d48b95c3a14df978d
SHA1 f1df21737fad62610b354ee99f9e67cf09b6a74c
SHA512 051cdcda489ca0e9e00250cee37e63381fe9d4347b25043f17385e8ae6ea859c51de2e461a11d05a3f4d4ef1e663a93261af8d76e70b966c240b4d31c278f88c
SSDEEP 96:n2hkyGt1b4juwpvWMoiVmdeHvSSv33UWQyV+VDCziEwb:n2hkbt14juGWMXd33ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2249caeecb5e81ad6ae65175ee2502f34ee07ba3711854ec51cfdaceeff100bc
MD5 a289f8eefb780ef9506cf2e96d572e2f
SHA1 b96850c78a9c544252f6d13e96a28235688fd3f3
SHA512 4b2a7b736ea1f4e9e0bec23961b34737426d51e1605d46f40df33b43462f43dbfffdbe022d3f14343d4f2ab5b7b88bfb73c010c1545fda4dcb8f80e0410ad7bb
SSDEEP 96:n2hkJGt1bCOojuwpvWMoiVmdeqmvO8GfqvSSv33UWQyV+VD7AiEwb:n2hkwt11ojuGWM6mvO1qd33rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba0d89cd256e832cedc3871c23465a0445c3681823091d4f6863491ba22bcf36
MD5 c92add16cbdbc33c0a10f0eb177798da
SHA1 1a992d32bd9fae4cfd4460e71b84d0114594e8fa
SHA512 1ec3dacff78b0b9526e19ddf1d3e91a054eaf0a8246149ae5b14ef58acb0bd503cae6473a0ec83ac63e4560621734b4d05d4a740fd2435e8bba88781b9d30cd2
SSDEEP 96:n2hkJGt1nCOojuwpvWMoiVmdeqmvO8GfqvSCv33UWQyV+VD7AiEwb:n2hkwtd1ojuGWM6mvO1ql33rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 cf1b66f8ea2a1429e13d0540eeafb6d1b5e4ac98113aa8c6a79ad7054e0a76b3
MD5 63f777149e421b96dac227317cdff0c5
SHA1 7463df3e7b045661c8d0b093cbb90769ad46f76f
SHA512 0e6c60b3786b3e1e40802f0745cef06b1873dedd7d9414aa71e4ff0d1e9e7c73651989cc0135d24fe5f2d3046de2dc9ee9c10686f42623cd4b87c58dbe56ad37
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c62e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c62e.TMP
Size 203B
SHA256 de6b1544f7c208f1a774f8920740d683a39e7d37a7f89da63cc7b3a33edf7b87
MD5 3de5f8110643c255a45ad8b5cda1fb4a
SHA1 b13ad1f90bdb18b3c1cdd91a32d768960bad7f2d
SHA512 7155c1e34ca85998be359d08c4e2269205f7361deea23dc0be0eb359b4aac7128e8d7cc3099cb7c9a82c175226bf1ab5b796e5d1e6959c0ef98046c585ac2b00
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 23378a5e097cbdc4bdc5ab0c75514ffc3b4e21aa648b25a0576b54e58ed78c32
MD5 97a5ea0d1b9752430d0548750b2f6468
SHA1 e9cf53f24f89cecb8164f75d8968b1690e7b38a4
SHA512 d2a2abc383b203d76b23400b3af0d0d9f717e229f4bfae76da666349455a38a3caff9017db6cdbad699413f186458fe88cb0c9c42afbf6447c481d20eba952ed
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJII+e2RUnVRu23z2OMDCRq:A9iIxuERzA83h09RZxYmzn2aOMWRHqlT
MD5 SHA1 SHA512 SSDEEP

Submit Download