375890ffebd7648fbe70f2c9867b0a8965a9d266bbe6b55e1e0e7e9f13af1d78

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4a4d007e4f29f32868d4c21ec07a5e4_JaffaCakes118.html
Size 93KB
Sample240613-ke2kfavemj
SHA256 375890ffebd7648fbe70f2c9867b0a8965a9d266bbe6b55e1e0e7e9f13af1d78
MD5 a4a4d007e4f29f32868d4c21ec07a5e4
SHA1 e81753617a85a96e90632d051a80918341b888ef
SHA512 3513c4fff2eb1d1d3809f5de917aaf0c5c5852142bbab6b8965efb7e88f209362630458264acf0bc9cf4ccaf781c1ec414f35a7084a723f59ec3bf2a9d61e48a
SSDEEP 1536:0YwkclC5FXYZOUOTOgOvDKX1OhOiO8I60x+AVBc:0YwkclWh3DaPvGX0g58Ijx+AVBc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1376	msedge.exe
1376	msedge.exe
3228	msedge.exe
3228	msedge.exe
4680	identity_helper.exe
4680	identity_helper.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 2460	3228	msedge.exe	82
PID 3228 wrote to memory of 2460	3228	msedge.exe	82
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 2336	3228	msedge.exe	83
PID 3228 wrote to memory of 1376	3228	msedge.exe	84
PID 3228 wrote to memory of 1376	3228	msedge.exe	84
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85
PID 3228 wrote to memory of 452	3228	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4a4d007e4f29f32868d4c21ec07a5e4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba3b46f8,0x7ffeba3b4708,0x7ffeba3b4718
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4654787164944844841,5687363785720677806,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 9c90a5064ef4f795e752979bd35be9440cee237c04c456a2386fba2226f0a8be
MD5 2e79fe7aada90ff9fada3c1fb262609c
SHA1 ba4c76194f271e7eda2c02ed23ff669f5fbd3ac7
SHA512 b6e4db7107b32d16b685af480463dd8c7708801a232e238c7c80179b09aacccd6b1fa4895de84b96e2bc2d09fe614da497786b13da74704871769236fc1eba24
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 f5fd708d56905b01aa5e93ed7bd0df1958bf47e0897668a22e6b183a7c7b79cb
MD5 8bac3eb7e558493a1cf99b375966b72e
SHA1 31bffe9d80ac2e7751510cb12ec9041e54a65853
SHA512 d82958a18670afa8abc3499482c4405acfd977a10195e8bf0db235b0f7471ac3be4950d5631605aeb213b87d8d67106b79c1c0fe82b3347d62da0298ff148ab1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 bf24b405a4c2d1845b31855cbd1a247ed9e5d293f7ed147daf4608e3c62df0cc
MD5 b926c9acbb6129df577830cf803d80c8
SHA1 4d8922dddd5643eca40878ba45b4df93275f66c5
SHA512 b5b0dce10c65bc6f70fe5f555fbd2eb961c6c9bab958827bcb3d1fdfa9b8e3b26e015c6a20839469cf4f019bd7b8f8254c069a15836bfda480aa794d50d88a2c
SSDEEP 96:gEHGRI76rpSG1GZGdTeGyEsGaGdOGc0GcMRGJGWGdMSK3GdMSvGdTiv:gEHGRI76rpSsYL+sJvS2RUzTSn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 4KB
SHA256 d5becd1917afbad45f67c4fdd67a5c3e9b0772943c295d5c8a04dc9a4ea84d67
MD5 25023424dcb4425fb2e71f6820cd4dd2
SHA1 f7752c14f66be22e3a213523ebf124f75b73cfaf
SHA512 1271446c034485567491541ff683e65493641c80da627407df3878fc296acde99a8338d91be0d260bb4a091129e5f1ece1b1f92eeb833b91d3d341daf82f1fe2
SSDEEP 96:gEHGRI76rphGdTeGyEsGaGdOGc0GcMRGHGdMSKQGdT2G/GdMSkpGmGWv:gEHGRI76rphL+sJvS2RukRGRpvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d7775087b22e293cc471782f8814eed29c7e6db50cb408d6e6d67ca38fa75d97
MD5 04731363a841f7324651f77b2ea0789d
SHA1 47aafbbdacbc0e13bccbb3a6413c5886720b6307
SHA512 7fecebb08f665c5b87b0c7cc336cc770436d7f6ca9bb3c83c24e5bf7057969864588ce2f9cf780fe84ac30716f701809d1e153cc778306423b516fef1d50642a
SSDEEP 96:nEkVoxm/DQYmq7A1ZGmwpvWMoiVmdeH1D+UWQyV+VDCziEwb:nEkfIoArGmGWMXsro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 246d79e4791b233f618a4544d87921f4c3569dda58a02c357e0e57309f0cec12
MD5 de2c1471ce23323b2f9954c2064f6c21
SHA1 b9945a856aeca9e9f1b429f5d3b722b201fed201
SHA512 33dd372f5c386e707a98360f30b95ab85dd6517ce772c2126ed852d714c2ced808ee3f6c6316f24a1b8ac9f14246060431d0baf027d940aaa7f134faee1fde23
SSDEEP 192:nEkf6oArOumGWMpbnhIBYVgdQ8WErZKnjDF2srV:nEdrOu3WqRwrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 cd304b71da6691b34111189a287a8d2eb3661a163cee57d4a7a267a1afeeb28d
MD5 95d9445502d50549c3e889cd21f4c7ae
SHA1 ec84ceecefc79322bd827c575b56f761964bcd05
SHA512 da4110f0270871b252f74f73ca4399df83797dd9cadccbe8e9853d5b27349bb92cccfea41d65b6dbc2e49eda95577e0e0b1dce954bd302486eda2b0e0f2a1c93
SSDEEP 192:nEkfCoArOumGWMpbnhIBYVgdQ8WErZKnjDF2org:nE9rOu3WqRwr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 78cd2e461a2bdb67853ceca6012e562f918d6f1598b9d0a99c31a83a29ccc273
MD5 7a2b1946df69ad1339c1a84904d77f4b
SHA1 45a38cecf08543012cdbc7003d1b0a942023c731
SHA512 8c4000c13615851ef4d16113dab5198510f081498df5841db98b810be759f3cd17fbbbb7cb18ab6bc43d1411fe46f32c4127d9b2d2d7b7cd693b1ec7b9e90790
SSDEEP 192:nEkfCoAXOumGWMpbnhIBYVgdQ8WErZKnjDF2org:nE9XOu3WqRwr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 0175aee03da8918d5ce0a0f311b3667556738b537350571c93640ad15a5b6233
MD5 d8e7e2144334e8de2a8aa6066678bbd6
SHA1 92009a8c0fa607f95d531324f1d4b5c7fbdafd6a
SHA512 44e397ee2e4582d0a4ea0ca01a2bd1c497a0dbaf2ed6925946d59340524a1d1a4ac43d6064a4d927a7a74e2828a7fb03d16919e0937851fb2df3c646269b2bc6
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe578ed2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe578ed2.TMP
Size 538B
SHA256 0de5cb236d25438700122aacdf71ca7f6ecd61075b20a493331a6af6aeeacd2f
MD5 d9958a9a9cd59b2bfe5cd59b48068f80
SHA1 a5b9ee071b6edfe88fd1ef53b4157dab631ea136
SHA512 10d0e29c7b318f37f779b520ce07006800aa1e1fe9662a9d2814c6823c3519b7236cabd7606c7e1e2a11cac5f429a9eff4fc2936aafd638fe03d7b8fa8db8319
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 275f9ae9c9c677437ec3ca2af06f9d78931b71582a30e17f1d24ca912fd66e38
MD5 234f646751021299c3902a43cf12b1ed
SHA1 b45709bd5f8338c1a71b4f0c918138f379e921d3
SHA512 4b58eef4a202c302405abc7925755a65e4573fc80eb972e0f935d70dbf9984266683d75417e0f32d8724368c3a927639e3ea3c150dbea1eb25460f62a00e64b5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplGe2RURSRsq3z2OMDCRHqb:A9iIxuERzA83h09RZxYOHGqaOMWRHql9
MD5 SHA1 SHA512 SSDEEP

Submit Download