712f34a7e82027ed978929070b27c1e16fcff8f8c2ba1b452e060f536b03e796

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91d3c23873512c13eef89b509af45ee3_JaffaCakes118.html
Size 97KB
Sample240603-pyb64sgb98
SHA256 712f34a7e82027ed978929070b27c1e16fcff8f8c2ba1b452e060f536b03e796
MD5 91d3c23873512c13eef89b509af45ee3
SHA1 44c0c3a66139911b6b737f9be10b145cac220db8
SHA512 76cc9e24525d88854c468e402027d18ce8ee059b0c75f8886b52a7b1c3e201740654fd74b0a636e51a0195e413ac04cb1bd20d7971536c7deb3ad323e8539f0e
SSDEEP 3072:jXShorhodbnckaYJNeMcTfgvMZeh+pcigX2cPotrUMD:+horhougigXM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
2692	msedge.exe
2692	msedge.exe
2660	identity_helper.exe
2660	identity_helper.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2672	2692	msedge.exe	82
PID 2692 wrote to memory of 2672	2692	msedge.exe	82
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 3756	2692	msedge.exe	83
PID 2692 wrote to memory of 1284	2692	msedge.exe	84
PID 2692 wrote to memory of 1284	2692	msedge.exe	84
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85
PID 2692 wrote to memory of 1300	2692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d3c23873512c13eef89b509af45ee3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f4718
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3004 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,7771237542241490,5792317664872299604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

16953898-ee37-45c6-a047-5fb319c15f5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\16953898-ee37-45c6-a047-5fb319c15f5f.tmp
Size 2KB
SHA256 74c773f4985b868c9ee6dc6956d6a1ce341c791dd16562221e6ae3517bf8ccf2
MD5 06eadb2b3ab31ac1bd71ab4e5f926912
SHA1 5ba8fbbb93cc0a94e77c374577f0c3eea7152f40
SHA512 537a094d2592c59b7d7817c3dc8f948b4471975e007adf1d67c21fe841788f0af8f70004f39547f64aedcd93f1eb0d0145ac6ef9086bcaf68866a301126f1ceb
MD5 SHA1 SHA512

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 cd088c7e10df229f9211b5f17f74b28acd3c83b554bc091be1d7925319b73179
MD5 f27a222ff07cefebc070e4cd3239cb38
SHA1 8b27485910c0ed870d9a9946b9f1e233d707287e
SHA512 1bafee45dddab471db74b92bbbda4a0da871d2abb72a865ea4045997c29d82ecbf28c798f38cae2107b56b7bd924c3ee75c4c184ee37da932bc5e4df09112e63
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 4c4d2dc6896bf4186a06273d8868d9bb912146d80baefc9d4be586ee75c836f6
MD5 fec2cec73b2e2bb3d0222d82893f6734
SHA1 160358bf4ac2eff16dc528b3aaba9a6270bcdd44
SHA512 47ed62c5092cd5a56c32c8c4b64f34d7202a7ded0703962bba877ff9f3abcd4ae7bd565dcf88cc4e0aa0412576ada00beac77bc2a7d2bcff9b783df6920a43fe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d5ed1ed450b93f6c27ce396364ba48363e7eb35dd8394d114032fd47aa150e06
MD5 9cbf415b8eb81897edeedf169ee2f9c8
SHA1 c9f99c4c16b00ee4600e8a480aef88daacf87de3
SHA512 ef86b83271f35157b790925284b4db37aa25e61938924d5306ae8c0a33c0747e60159603b702c7f0a37017e5ffcd0776ac08dd759e78177f42e8f8ffd80ad7e8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 45401bc275f2dcb4d715ff6cd6c0d87fa7bf77ce463d08bddccc33b48d483dab
MD5 07b7d68dd8b6d41a8ee61edf37951c36
SHA1 da6a06bdeb788cb844885f7a0282e73ed2b94585
SHA512 a4f865c8b0856401bbc7c206a95473420203c7ab8da1ad0210cbf5d6419c3e52384990f884e4f1aa3796392e962b26d60018dd5c20974f11af8af2dbde017e3c
SSDEEP 96:n5kRA91OBwpvWMoiVmdeHBrzG+UWQyV+VDCziEwb:n5kSgBGWMX4+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 1cfb12140c7a11bf1360a377281020cb7cdfbc79267d5f1ebd3d3c52331f4682
MD5 77340029fbcd68543358768e7a94ac28
SHA1 3b1bb7f1aa9ab9f7f1dd6dc1e8a07fe48d04a81e
SHA512 650408253f3ab30c74eb43ee5972a125469370f6508279205b3f12725dd35ae5529994921292501d4393ec0fa1a120043058a468c051ecc5e7d4356afd890526
SSDEEP 96:n5k8A912zwpvWMoiVmdeDdfuFvmg2Br4G+UWQyV+VD7AiEwb:n5kJUzGWMTdfuFvmg21+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 62dd793ff55d7854d27b915df236d4fab415b873a8022e671002ccf248f2fe97
MD5 74291322bb0aff8b47ee2d84f096f213
SHA1 e5cf3eade4bbead25ebcdd05212dd08b46d0feb5
SHA512 3413ccecc49015de1e07a0d5893cc1bdd187557ec436a3ae9fd0da71155542ad0230875701bb076b709b3921ceae2265af64d87795e67c764590741a4d83c2f9
SSDEEP 96:n5k8A91OzwpvWMoiVmdeDdfuFvmg2BrzG+UWQyV+VDCAiEwb:n5kJgzGWMTdfuFvmg24+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 09076edf4a1dcf9f763fbe4c167d8b1da2db58bfb329f20b3f5026d3b4dcc202
MD5 577f8fa7f5479dd5840fa9a67cab068a
SHA1 fb3368ff1c4c15257689deb843bb9e221abf89be
SHA512 f68032cb1f590a5eb29be96d1dcb5c34aa24a6c671f131daf268351ceb04bc83151fd1a60e950974c49cabc8ebd8dfbaf8b5ab01f190ca6b7aef3d5ac69fe94f
SSDEEP 96:n5k8A91OBwpvWMoiVmdeDbg2BrzG+UWQyV+VDCAiEwb:n5kJgBGWMTbg24+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 358eedfd38df7c41e5b9f8898c94ae88e589b18321013803142f8b27472ff2fb
MD5 d65ee66d4cc8432d48c3d6653229144f
SHA1 9ca31d1a8e829a3500742637afe81107ebbb1406
SHA512 39810cb2659555dd23181d62cca87d2c065804b898b43549092fa2957461d465b8a6fb441b38169e92329e8de4405d035664ed60331bee60bdd73418961af8d3
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe586c51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c51.TMP
Size 203B
SHA256 e843dd4e01ecd7892d212b1f08029d6dc907297724e158e521ed388ec3b8ad39
MD5 b568585d2eb8abc56e02c73fab56878e
SHA1 653c016253eaf81e0a9c004d9cd6e97f37fb665b
SHA512 4de95870f2eaad55b050091199240aa3b56ab0a303d9252a139d356739c6e1559058861ccb1259e8b74aae65875d7df74075e25a3b2e8b88cd5ff89cbcd8ae5d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4d3dd3c0bf54aa9cad35b6be5f1fd3af60772c2385453f56ee6175492b46e8fe
MD5 229c0f896f519ba9c28c72dd62bf60f7
SHA1 df093979e031cdcf446ac986bf2202538fc9f967
SHA512 a0d21e675955a6f3b1a23a7aba4049047f25e81958f83e44912ccc27edd38203bb2cb251a20badaa08726a20132c83c027e940ed00a522fb633a14c346bd4339
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXRoHxde2RUPAMj2w3z2OMq:A9iIxuERzA83h09RZxYiHx5qLywaOMWv
MD5 SHA1 SHA512 SSDEEP

Submit Download