354593e69525918d1d63227dd9f1a87b729a68dd14f15d859c0c720c0661d3dc

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a55ae77a53e17f605659cffb50099796_JaffaCakes118.html
Size 286KB
Sample240613-nvtfjsxbrc
SHA256 354593e69525918d1d63227dd9f1a87b729a68dd14f15d859c0c720c0661d3dc
MD5 a55ae77a53e17f605659cffb50099796
SHA1 5b3739e37b55f34b81efff65509ed632a287b0dc
SHA512 55ef705a6759471c51965594b12d6a92693f62254afbe57c69a222e4815553b5ad30efc9b155819dab68379c9fd3f295c806d3bd880c18bba9b1fc1232e39e9a
SSDEEP 3072:TmWs/833neIqdW6+ILUyvUYOzllbKTo2JVgLdKWJcPC3M16/ch98GTLV+4yiUhzE:q/8nSdNZLHvc+WgZPoMwg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
1452	msedge.exe
1452	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 5104	1452	msedge.exe	83
PID 1452 wrote to memory of 5104	1452	msedge.exe	83
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 696	1452	msedge.exe	84
PID 1452 wrote to memory of 4836	1452	msedge.exe	85
PID 1452 wrote to memory of 4836	1452	msedge.exe	85
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86
PID 1452 wrote to memory of 3420	1452	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a55ae77a53e17f605659cffb50099796_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff934fa46f8,0x7ff934fa4708,0x7ff934fa4718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,14415071058874499149,2474786109904559262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

0e08259f-2fc7-4c0e-976a-62ce59b22b83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e08259f-2fc7-4c0e-976a-62ce59b22b83.tmp
Size 6KB
SHA256 b0e7cfa73c33de2f60e755bb1edcfede82764e6133b01f8f81c173b023142742
MD5 5a2ccaef906a616fbc488328a55b8438
SHA1 c085d0e7aadf817d90e407a9ced4f1e59313d47f
SHA512 353bd842162b763274076df8c973b561661409e65d52b92c5b14fbf66d716ef48e437bf5724bac69cc60907b0c8051878b05314edb0476e88d54f9960f3eacc5
SSDEEP 96:nwTkVoxm/DQYmqAM136W/wpvWMoiVmdeHgiVmP1TUWQyV+VDCziEwb:nwTkfIBMZ6YGWMXVmP1Tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 cb7cef1a668c431e2f80102be442034ae994d9c756efeb5812494e530e7fb838
MD5 5225494b894713fff7d440c7f389f6f9
SHA1 16ff613e7a2b01eef15122efdfb5e582de8811fa
SHA512 cd8e3f399931bb537ef02462bad8b1836521c4836b246aad0335e4d7aadf1a5012b5f6b9d6b662c806db3e030711a786737c2fedfb38eee89026c3b49b87df32
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 fefb74c486defaaadd08bb2e1add35a7d17d87165f0f57416de3caf3ebd3dbbe
MD5 b6d87084dbfca444afdab839c508b2fe
SHA1 61e8cc622a92f232948555f077958c3844c4f67a
SHA512 f41d51aafbaa1997598d3a3fce8e15d0664c314563f049b3c26800183b76aab635c420e12ff9db05235c4369f640187d7b011e3064b299d0311c51bf90e0cbc4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 647e695856fa1a34305dd9d10e270c6f86e559955d775ff6394f1a186761e67c
MD5 f48e395f34676b0cccac4b3db5bbf4c4
SHA1 28e00cf9b801faf177dd958843a702807a747216
SHA512 9f3970540ae7a76327e4c17d548dd47199450b297f7ebf33cbcb33890863ad87fc0cfbf6754ddb0280ad1671362ae0a5fd5d6fdc18975e9ca3756ccc2dea0763
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 0d0b44a3c704d25d9b17283263f87013f77f5d9f6b18f982f1b25b6db7060a8e
MD5 3175b4e5831ca0ca8eb5f00339da31f3
SHA1 98aa3020c1fabe2ee5784e96377c4e13b1ab2b04
SHA512 3fa013b28175d508ffec589db7448902b75a310eb53f588d01f8f1af10c8605b7745b57e886e82c6026cabc913665740d092d2dd27327a69c5322db410479847
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bdca7d8eb928c92c1139da27e976a2ac94763bc2c235e1b8be3cd607c1da879c
MD5 e85551796ce3158138cf3a98ab58d2a1
SHA1 876aac4fcce0eac6a94cffa5bbe7a26e3504d057
SHA512 0d86414c107c664d42b9ceff453eff87ac23a51617a01c8fdb98032f2ba5cd8a9743849e4e5a2d0197b701b513ad0654d75f38828a92779579137312acc7d23f
SSDEEP 96:nwTkVoxm/DnmqAM136W/wpvWMoiVmdeLdF72giVmP1TUWQyV+VDCAiEwb:nwTkf6BMZ6YGWM7dF72VmP1TrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6238e06c4361d2d41d127f5e8d7cf75799d406efb61a853a3af1cf76d043a7f6
MD5 ba67cff9262c9585c8234273c1cca40f
SHA1 918538541724000d001e169ce08b316706207cf0
SHA512 2cfdcf217aa22b265e6ba6743de3d34019e950e5c18f433fe0b39e93c9d405d60363fc5fe2679e89e2edddc4a6d99924852e95391b6a69f7d19bd5f32bc9996e
SSDEEP 192:nwTkfCBMZ6oGWMT2C0v1SdppF72gmP1Trg:nwTvMslWCj88THr61Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8317acf2d334b44717b9c5affbf063ada7d9ede7c06bbe6e730b5b906ab890b5
MD5 ee9be8aba8b7deb3b72b8958c452248d
SHA1 bac1e901fe124ed5ce8e142eb019d6a53882f069
SHA512 07215d869fdb82ae5c2b8746d91177adc5882b854e2564b9c49a74b239ce55c0e5b2298000bd0355ba16eb94422eb851ca0802d2e7fea2aa3f1deb69ae44cacc
SSDEEP 192:nwTkfCBMZqoGWMT2C0v1SdppF72gmP1Trg:nwTvM4lWCj88THr61Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 adcc6a495005cab560dcfbd8d7580d72d02b0c8df80896e3d25f7ce6e5169f96
MD5 ccc9126b4fb930be281fa2f51f6c337a
SHA1 d8540a1c3fce9b51b3755ba75bafd0fdf0ff9d79
SHA512 483dc843c67ea014d29bff25c5227c38e0fe5651c9a6092fea7c8efb24c472763d836fb211943a2b3e8d296a7fe315e18b59286122ee2c24fa6f99d889a3a4ea
SSDEEP 192:nwTkf6BMZ6oGWMT2C0v1SdppF72VmP1TrV:nwTPMslWCj88THG61t
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 8229732acfcd3423b586dce9d9d334f25a467745a82c1bbe9835dccd4919337a
MD5 f11bde94254855b90252e368fd464b6d
SHA1 fa8bba7eea830f893a5037b86e04fe2dd1991ab2
SHA512 a9260acbcb95bcad31ea3bc4e2a7ebd0a85af2f5b8ba7ab69786b4b5491d0cbd9c122c1e64ee180959b70ac3a43338b3414392ba702836d31e65a6d073742c91
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 3dac703b4211b47383c2bd85744d65028e40acac393b72318baec37a9b880ffc
MD5 e1dbaea0163f045d61184c38772c49f2
SHA1 c05195cfeb2f92957431cfc0bec41d7dda8c8229
SHA512 25cb57ab66bec7baef563e827c0216fe449200956da8afa26ee72e9b635a0463f8232099ef0a5923be789a43b7cca0e23e9aa4565b1e803a5d1ae3090a2eec6a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 f6b596f2a0ade1955e069e70efe27f009f0267a7ad48df528823987078bb5614
MD5 d3e91134d30bcd38a9f0fdfe8bd30726
SHA1 af6ee459f6265c42b20a28e7f43dbe57e86af9b1
SHA512 e4fbf2e786182921f6f0733cc7770fbdea21dcd5dd6c305e0704a2820116f0c8b1a2561b9921da17104c065b94a5a68438cb8c63871b8fb60296ee87e8dbec0c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 f20cdb29cfd410a11ea2b2f8f6b925fc720783bde235ceb9d98fc8e72ab83c86
MD5 cba9141235517a9cfbdbab75f6ca440c
SHA1 d2ffc75ddf8134baaaa7dc2b7db65cc09524fd97
SHA512 32ac4c4e65dcb8d37d465f0c0797a48be956ee5180952ab2986fe7d65eced8c03a7ff0312a728e6568982da6f4a6f6f09bf8657d9027578ef4d935a18f6f455d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580fe9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580fe9.TMP
Size 203B
SHA256 d38659d819a2762e744bc83050564a2754c0bb11ca98ff43ddc3e3405a22189c
MD5 d963f8a53c65fae1826aedcfed0844c4
SHA1 1d8b7e0f9a9ae6287a9a010f14dc2f6e5dc1e85d
SHA512 798e972c36b7c044ad8c1e088381ded5ecaaa93ea51367d39757ad5261acaaafee1c62ebc0f32661af8b51b66054284a5783ccac041a96d4d782eb31f3e132ae
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 76011754ebabd545d1b8602413b9467f5a10e1eb95bf5669eefcacc9cf942b0a
MD5 3a838697c3d12748e6edfbb50a481da5
SHA1 4b1394fb5ba9ce0b5ad24c6753dc657a8da3b846
SHA512 5063eb88f87c5f836d5fee87690ae9711ff03a889c3d676f17c65b1f15a654c8c8f7d755c1b249c283e8d14a7f26b3ad0a7dbfd5d55174c7d531cd93aafc0f14
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkGMe2RUmEP2kRc3z2OMDC4:A9iIxuERzA83h09RZxYkGSjEDRcaOMW4
MD5 SHA1 SHA512 SSDEEP

Submit Download