28362248fab181701bbaf30fa9162263604136e0984ad872688f75983e07b05f

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c2f90b052dd9b05bb010735d4d92375_JaffaCakes118.html
Size 140KB
Sample240528-jddxbaba9y
SHA256 28362248fab181701bbaf30fa9162263604136e0984ad872688f75983e07b05f
MD5 7c2f90b052dd9b05bb010735d4d92375
SHA1 89eee667d5332d12c74764774576b5696758020a
SHA512 5f55029a628220eb59df7c34834273cab9ec425d8e3b4931499bcdc461e8c4130afbc8099bc0c2c0917a550d4827d6f4a5d8ed3e7e07a1c765290a81e5a063a3
SSDEEP 1536:ARVHv78pMJmrEDONOHOSEON+OBOF8WH80WAG1C:ARVHTsIwcuSTTAFznWAG1C
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	msedge.exe
2608	msedge.exe
2540	msedge.exe
2540	msedge.exe
4028	identity_helper.exe
4028	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2480	2540	msedge.exe	83
PID 2540 wrote to memory of 2480	2540	msedge.exe	83
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2864	2540	msedge.exe	84
PID 2540 wrote to memory of 2608	2540	msedge.exe	85
PID 2540 wrote to memory of 2608	2540	msedge.exe	85
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86
PID 2540 wrote to memory of 5016	2540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c2f90b052dd9b05bb010735d4d92375_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff631e46f8,0x7fff631e4708,0x7fff631e4718
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1420 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16510973892387644752,16469462035759538586,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b755628cfcab910f7a3bd3e8936ee625bdd0e769e590c799a13c0379f828d1e3
MD5 c4e27dfa8c8829ae9dcf9d6648f2b650
SHA1 22276f00d0fa8b89ee6613ab9053e76b20487126
SHA512 58bdfa1bee8fa252fab2cdc2bdadbe43581ab8f7d33ee043f1b2fa08dead75b257842cd29db0dbe5d3c9c08db69ed2459ce9f7b125c57d8e52e82e142cc9b93c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 f01138b60e401eaac9dc4d0fbd246eb66ca895012dc376d291687810c4bdf725
MD5 dcc06e83c502f735d7c981effda0c609
SHA1 30e2a46692945db0b516dc875d741c278c5a6900
SHA512 4b6a95b642621994d760b81d8b5b82b85e7f9fa40fa8d239f96c5b1f1c930ee78e56ecd5a55ff50373ad185071c69bf8e7dea068fea8db64bd613ebf9abe1c14
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 aa2a7ea21ccb6625b3bfe176e2dcd0b6f048d9d224eff79d89fad98ddafa0573
MD5 8248bd119d35640b955eaf8faf72a7ed
SHA1 d2a022d0aee95558f1731cc88ae958025ea83875
SHA512 97a617120a0cfea6ee992daa8293f5726d884ce7a003959128d3a634f98e12391e9221637aa860425f1759792016ffb595ce775a188e0b67f945741368fb7653
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 77c05884844543fb8e5cc4dad4f70fcae89dabbf47a774c72e5f4ef0dde78e73
MD5 b0cb7862277e4250cc649c6a7b758332
SHA1 b0cd1b13f5264049c5229a2bd05f3493dc844008
SHA512 a5607a3d3ba0385f79bc347c6ef89ed3666f2500936489e83382f8bfd9ef5044a4266b128a7ece9b91f857cc25a0cd20613db49710b88bb0973c95d8b04c4a4f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 40c22e61e65036bb40edb89ab2bc0436a3cb7d3d2461687acbc31c5ab098423f
MD5 6c227fbcd3460d7b1c0d46dd0469fa5e
SHA1 15c6b94e3ea14b8d833fcb77113e10b27531c27c
SHA512 f35f77af1e7f2f038a052795370baf6a8012f0f03d79ffcd8c17ec614a0cb59bd07d2a2b904eecab0723b48a6ba654a805f8d983c73c4c2c55497ffe71b4a2b4
SSDEEP 96:eceyzhw6rxXMTAwGDPGo1sFGOGKE5G1Gb+qn:eceyzhw6rxXMTvoJ1sFva5Um+Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 ce083bdc9de08145304330dbfe37e811b95666ed2ad75c1e73e6d31133d7b3cd
MD5 02177024b005c159bc769aa679deaece
SHA1 c4a036628744ab37479a189ce4998a24da93d7e9
SHA512 4c6fa1910754e366c85c11ab82602e0b9ad122a5d95aa424c5c36ec5da696c98285f0dfc8a8e01033a78ed70821efedb07e9f92b645ea509aa0773845965d875
SSDEEP 96:eceyzhw6rxXNGDPGvGGKE5G1GgTGjOGFUGQGbGgGTn:eceyzhw6rxXNoqGa5UzT/KU5KhS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9f370ea975a3dc6940cb5b60202211c0bc4e6847a2cdef4f258dfae6bd893aaa
MD5 b54684c0b9c20ce0a0b9465c753d7128
SHA1 0a1fc96771fa985c44c04806f302c9df7e5ca05e
SHA512 49e0db5ae304272950efb9f7f3a51045b7b80e45e024e106abd3c7a21e6b6710aac61458798ccffc5ad5579d2f7cdd67bcd9257052f1a1142f8478c9dbd8bcb1
SSDEEP 96:n7kkd1Fya72wpvWMoiVmdeHk4CglUWQyV+VDCziEwb:n7kYnya72GWMXoglro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 58011de35d6b14e84cb1017083044c24ec49254bd58b3b3bb2d0ce5fb6574fea
MD5 b573fec5b7d8eb6f24689b9c0fada072
SHA1 1c6b690d0376c81cc08175eb5f95949b454277fd
SHA512 24b3524c36996c8fbe4d60dd402f009d3143c096107cb1f46ee74b7e20e495594c3914bc130af1fb15da91c8c825336568d496b6f505ad6bbcae7400317d644b
SSDEEP 192:n7klnyaS/2GWMePAYgBIEryxss7f2oglrV:n7gnNS/HW9Sr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0e1aa4206fb0bdaf6f00bf235900e4a36ac08636fdde949696268f5231baa003
MD5 ce49cce0f850c390160814d45b7c6a5a
SHA1 3e0e3abcb8a75ddd4e6325964f7f2bafe0fe8c4f
SHA512 b0eaf7d0f83f99c47eb25729e9cfde8985006efb33291b31a6d12bd9ee98d85106a82c36bef567ac301d9933094160abd0ee297d0a4d699052c31d242a811bf3
SSDEEP 192:n7kJnyaS/2GWMePAYgBIEryxss7f2sMglrg:n7YnNS/HW9Sr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ad2237b351a86f46417e54d31addb6e60adf51c2123f1df87663c5948e5654be
MD5 befc15565a1cc296db6ff41d5bc9ef08
SHA1 ac7264752a12353ed74638e2eb120ed059d5ebe4
SHA512 e640b5084427d9bda9ca0715ac219b8b2859e358e53770b67b48515c4da1f943dce911a005791dcfdb32408774ed6ea92eaae702cc5ef45e4079479cd0b50e7b
SSDEEP 96:n7kvd1Fya72wpvWMoiVmde3x2k4CglUWQyV+VDCAiEwb:n7klnya72GWMHx2oglrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 2feec2f90f4f68b743220f626fd1ec17dfcf964942749b7ee98062ff63197eab
MD5 63267027683ba21be22e49cd18891766
SHA1 3d464bff26d37d190053643658c4f3c805d02dce
SHA512 3f002e4d011505977546f8ca81fe4b8eefc7d3b498e45e7f9201735472974bd82847428dee6b02a1efce0c65bc3ea5f0b897661d6a66b40322a45abb700f6280
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581b34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581b34.TMP
Size 202B
SHA256 26cb9dd9d4bfe3aefdb7766f6b10ed47b7865a742e6b5219976a3dd4726babbd
MD5 de0ebaa649ddd8e8c7e035426dce0928
SHA1 ef154951c26ee2aa5d7690f0c267d30b67560b5e
SHA512 eb22a3eaa6d6c9bb4254a9058e8be0922228e236397bddad1222ed37239c581a37e4f109cd8529f9d684b4a77becc0ac8b38ecf128817b972002636b4e30930b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 83d8580fffd9e8efee0f1197a13122c6ad6985758588bf879dd3ec3eb61a8793
MD5 0dbb80f31e81304d87bd7ed5764f519f
SHA1 dd3f34af4026e0f32fd341d553c36aa51f7108f9
SHA512 70cce660030dc91416c4b820edfe394bbe0125744a6f21b6c5733ada96c8cf8543715010b8f40cce2080792022b4bdb38736bf690652ae5fad6b83a4a362c16d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplg2e2RUky4VTK3z2OMDCRQ:A9iIxuERzA83h09RZxYl1DTKaOMWRHqH
MD5 SHA1 SHA512 SSDEEP

Submit Download