86077dc02b039e818b4267599e8269e589a62ebe6fe453e08749f845ba6da33d

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a356389ab6dcdc4fbf89292d6b5789a0_JaffaCakes118.html
Size 36KB
Sample240613-bp2thsyfjg
SHA256 86077dc02b039e818b4267599e8269e589a62ebe6fe453e08749f845ba6da33d
MD5 a356389ab6dcdc4fbf89292d6b5789a0
SHA1 3f0334422bd5853c3bd932f4b2790ba9ab11709e
SHA512 06cd427d1ee05f293fee35b540ea10f17df14b127f7d4976dcbc405b7ff6e09986bb58a7947e2fea460384532943d7f7a09d96be006f6e8bfeb11d9a57c50734
SSDEEP 768:+mjynOHVFasxOfoi0ZzxRBlTYVVV14g0LXdx3pyjxi64kSuu4J1n:+mjynOHVPxOfoi0ZzxRBVu/14g0jdx3y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
2916	msedge.exe
2916	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
3560	identity_helper.exe
3560	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1532	2916	msedge.exe	84
PID 2916 wrote to memory of 1532	2916	msedge.exe	84
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 4880	2916	msedge.exe	85
PID 2916 wrote to memory of 1580	2916	msedge.exe	86
PID 2916 wrote to memory of 1580	2916	msedge.exe	86
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87
PID 2916 wrote to memory of 4572	2916	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a356389ab6dcdc4fbf89292d6b5789a0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd894146f8,0x7ffd89414708,0x7ffd89414718
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,415065980552022447,7709626157407055570,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
  2⤵
  PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
MD5 257c0005d0c4d0bb282cb470925e4376
SHA1 f9b8efb511ed64292568977c9f2ec255509e8f7d
SHA512 2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
MD5 4819fbc4513c82d92618f50a379ee232
SHA1 ab618827ff269655283bf771fc957c8798ab51ee
SHA512 bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 635bf7b69c50751f22b00d3b2f956177925baf665f93f2a87a94bfbacbd53928
MD5 9048b47127e38daa2cc02f3971ed03d0
SHA1 20ecd6653912ad4adf1bb1d30a5dc7398a514865
SHA512 3fb67e1c93d7528338d4602a82e490f9d55c0d7b97fd1f901050cacc6618e8caf22ebe2e2cf2ac165ffc923988dcfe76f1bbbe9df008c32942851a39374c403c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 bcca7ba8c660c1756f39b79adba548d1229a962a98032b655b521a1ee48d2a6b
MD5 20b1d8048322419bfe20a414fffe2c9b
SHA1 1e56fdf909df0eaf5bf439ea2a69c584d3c6cd90
SHA512 a07ef0064ca16ff728ae1863931c27cd510a71748adcf6db01c77f3142f9819db7d86ef44a343e67fa805d62806ceb04fb73daef22e0e82461aa17b305ce764c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1ecaa7ae78eaeb872405528c5a58bbac594592e72057b081485200d3f31775e1
MD5 848534a6be87488f3d874969a6ef00f1
SHA1 c03c7f382fb1e3eb9b36a284f0dc42069ce89fe7
SHA512 7fafae9d2a4af099fd6e255a572dca12cecb8386d23de390a5458efd5e8b56b583bb1b0650b329022a883a067301b7fc0068c0bab22aaeca5740f159ae1c80e7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 359268992d54615ea1fdc13bdd10aac2ba11ac6bf019c56baa5f0fba8986b17f
MD5 e4bac997e4c5bb70ee4af02b5693fd71
SHA1 824e8b0d1e9f039f82d4de129a5efde3bd636379
SHA512 63a66bb3b5127c9c514050b42319282b3d77b8039705da80af0d3f1f677cac945fc28b74bdcf8fc78e3f750b738a717eb0abc6d432a4093afcd2959403d2dfda
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e64e00f9dc9c7b0e7be68e4806e355073c67d69c994e9785b6961adcabc9bc2d
MD5 7a0cabfedcd32362eeca669bc057d183
SHA1 b58bcc1a1f67d8c31138bc7fd4e92c928c4d411b
SHA512 66a60a089f40f552722bb71b9de34b453a3438ab24db272161d4f972d6e79d19265a86ffce762314819d4386d2dfcfd2445ec2dbd1b034af68378669825a0aef
SSDEEP 96:nYkIYgm/Dnmqq1ccQJwpvWMoiVmdeEFpRkcX6DEJh22W30pYUWQyV+VD7AiEwb:nYkR6dFQJGWM0FpRkcX6DEJh2cpYrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9226e7921528584c0de029cf43433ad8ffc783657b17df01226a4c517a660ab9
MD5 a6a2bfd2b4879959183ddad6e7e53a9c
SHA1 40a7f01f97d3e931804ac31bb26a12886532cea3
SHA512 35376e3a5ed0bf3e15dfd0342b4d233b88cfc59c5653f4da18434ebae99a5056c41667870203901951eab45c2b206d4e50bbd2df0ba7b09572d45d380f875b83
SSDEEP 96:nYkIYgm/DQYmqq1cc0ZwpvWMoiVmdeH2Wf0pYUWQyV+VDCziEwb:nYkRIdF0ZGWMXEpYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 973e1c288b62125059007f8baf653468ebe61c3f22b8e78ce617e6882460dc3d
MD5 9c6653030db7c5b70c188430d11cafc2
SHA1 3cb1f55c9b5f57af8ab87037226fe3c6b5fa576d
SHA512 efff6767e714c0065d9999f8a98a1f95dfb2f44be8f2b11a091e0393e087154babf2d8cc4424b4e6ca13d7a9f90eae679388115351536c7e2edfa0ee75fa2f1d
SSDEEP 96:nYkIYgm/Dnmqq1cc0ZwpvWMoiVmdeEFpk622Wf0pYUWQyV+VDCAiEwb:nYkR6dF0ZGWM0Fpk62EpYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 17f79d78e4ae0a3a325db3d192fe2deffe969c32e5c53e14e3281ab7204895b9
MD5 c8d438e32da685b9062e92f3105fccf7
SHA1 816a8120d2d35aa5cac1722cb1a0001101ad9c42
SHA512 05b03fc80bc05f2b1ca4e557b99d66ae909158a2ebc40d650628efa582dada4588ce585c0fc35f9a7518e822ea319c435a7e888d4b1ac57df8ec8e1df40f9b6b
SSDEEP 96:nYkIYgm/Dnmqq1cc0JwpvWMoiVmdeEFpRkcX6DEJh22W30pYUWQyV+VDCAiEwb:nYkR6dF0JGWM0FpRkcX6DEJh2cpYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
MD5 95cd1581c30a5c26f698a8210bcab430
SHA1 5e8e551a47dd682ec51a7d6808fe8e0f2af39e86
SHA512 e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
SSDEEP 768:ntEW/l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHLlj2rUr2A:ntEW/lu1ja2L/rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 b7b15795bc78d7e5ba85d6d2d3c1b9b8286fb25d02878d17d01fc76762157269
MD5 67fdabf77a54157212927477500bc53d
SHA1 42ae4ecdbcecc145bd35e1166f40cfbb7aae1b82
SHA512 8b157c26cc71a594c9140a3592c542a22be294508ffa8c3d0ab4a692e6b4933ef6e6e7b5278722b389c44a6105244c627f6164ee29562dc6d5d4271fbfa4ebd9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 466087117de44ffbd294f9669d1b070f36122a9734775474bb8e9b112c15a551
MD5 683d03aae810c79b52b7825f8015ce0a
SHA1 86d91d6a570f4a1b84ed7a2be6ad8d426ddee8e8
SHA512 f54781f16e932748db35f3be37a5f44a4b27e2105c1ce4c0d3474622a7e76a5ba1f3e339fa40eb0cece3d9370c747e89753f625eeb28f781d95cc6ff3359bedc
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57eea6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eea6.TMP
Size 203B
SHA256 5dc77f7bbbe1091e5d75cbbb5f9c25d74bd9e7c7ff2c3f6278b27ddffe1065c8
MD5 05cfa65f7c5c045857adeaf801bf1a4e
SHA1 2df993bebf93141789b53ec92a0425aeb0a811d1
SHA512 183741a13e80d69e4b9aa095b23ed7fdfa8de7733bf2014280b7f062e90834c75d30677e97437f4975450097059ba44e784e863fa44bb817e0738fe304e94155
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 31941fa79a61b3ba0cbf7cb145c82c6e0d4cb8b50d68154ff6c8622d9eaad338
MD5 c7a12aa2677135adb79995693cc57168
SHA1 267d7ece4105dc858a3569ad3af1b1fd3ca89ed3
SHA512 30018a1c8d4fb566ed37f33bbca572a0347039c89478c8377d953292a813ea2e144519da0a4518c0dde1844d6f577b1e7c1a4ed0a740d19326e97775efa34f7c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKwdHf9e2RU2h/w3z2OMDCV:A9iIxuERzA83h09RZxYKwRBFwaOMWRHb
MD5 SHA1 SHA512 SSDEEP

Submit Download