6ede352cdda441f68139e6a77ef5a787c1c0fb689cefaffc2789bb9f09281c04

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a58572a03bb770756c128862d43ca316_JaffaCakes118.html
Size 153KB
Sample240613-plergaycqa
SHA256 6ede352cdda441f68139e6a77ef5a787c1c0fb689cefaffc2789bb9f09281c04
MD5 a58572a03bb770756c128862d43ca316
SHA1 e584c3b66aae81e8e8e16f2a0afe7afa77893ebc
SHA512 c7b00887db81c2f8b183373dc0bd6d835948f0919e7810d893f3f1cb0f23d628eb1070372e87553d6df593066b18f960818f5475927951389c55161f00577abf
SSDEEP 3072:pPKQH0T07c6QLwDmRTB7l4L3eDQoxqFmbiZt43gsZb4YJq11056by5qGPCdlEFI7:gPSV28
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
4716	msedge.exe
4716	msedge.exe
3388	identity_helper.exe
3388	identity_helper.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4928	4716	msedge.exe	88
PID 4716 wrote to memory of 4928	4716	msedge.exe	88
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 4528	4716	msedge.exe	89
PID 4716 wrote to memory of 3008	4716	msedge.exe	90
PID 4716 wrote to memory of 3008	4716	msedge.exe	90
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91
PID 4716 wrote to memory of 3576	4716	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a58572a03bb770756c128862d43ca316_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffb186d46f8,0x7ffb186d4708,0x7ffb186d4718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13601202580103265796,13497074239277459677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
MD5 257c0005d0c4d0bb282cb470925e4376
SHA1 f9b8efb511ed64292568977c9f2ec255509e8f7d
SHA512 2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
MD5 4819fbc4513c82d92618f50a379ee232
SHA1 ab618827ff269655283bf771fc957c8798ab51ee
SHA512 bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 611e77b9b5ccdc4ec5b6e4f56310f667bb28ef90740e216ce19293b512347918
MD5 f5ebe95f26f353bd3540342c0edcb485
SHA1 934b889c1834ed75d7d58b70352f9d0aea0b2280
SHA512 84de4022d5c11577ae44109955f75858ff2da91defeb5e813b2e457f0830e972e910d59f78919c358d3ff59fe7a542f971bd9fe5848713403a1aa8bb0d09a7eb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 964B
SHA256 378b7008eb4766a076ddfa40311f5f642446db008883ca721e932eed2d6f567c
MD5 f8021a62f7d0b49840432a9b41959812
SHA1 d537972cea94e95af421f7bc3c37908aad6286a1
SHA512 792f5d4c14379f82862cc930a3d493aef61e538ff59f9d91c75ac88d51919ce15e1cd9a7034afad41ae7668f7ef845b2bd711cc74e9342c41527f2b3275c6bba
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cc66d9b980921d836df98a79a72848401e45c19568dd1efce2a26abe44d6d48d
MD5 3a0ef755f6d8a88898a5e32336e8ef23
SHA1 01658ca63f8daa79035423a61c7d26329c7633c9
SHA512 31e95d814a8b015e0bfb9c93dd16380cb8c4536b005ff0b44efadd49a106aaa174b111dd29a009c512d772a0c79ea6590dd075bd8e2a4b50381008d00e48ce48
SSDEEP 96:nw5kIYgm/DQYmqAf1BtmtZwpvWMoiVmdeH2WfVsJUWQyV+VDCziEwb:nw5kRIBfvtKZGWMXFsJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ff8c989ce5ebca4a3d6a2a4259512b53dddc37f4a94df9f1a58dc6033fad2b27
MD5 09fd1624c5e8a86c509046a9135f810c
SHA1 462b0cd387a8a838c67dfa4e6ad066a9426fdc1b
SHA512 29ee24c43e2164bb3fb2f5e003206e8358209de54be14270d6f09c88df78f6b3906300fa7400234ab66226c5ef844f1d0076a24bd932a876ab707993c18fe9ab
SSDEEP 192:nw5kR6BfvtKZGWMFijf1ik6iN2uHb2FsJrV:nw5hfvg8WycdDZAsmsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 27e92b8f24c9e339bdfb0512f5d5e2c70ca57edf8ef6f7df95f96b00cabcc4bb
MD5 556af3b2157ada0a2a7eb3f31c1ea176
SHA1 1e4be0cf4819279d964fa457f625081f195295bd
SHA512 7f6fa8eb26b3d1e206b8fdab66421a0384d84bfc9d8019a0583655376638f83c103208f1c4cd630478123ae3ed1ce2161382ad868f5d536cb7e2af6283b0ede2
SSDEEP 192:nw5kR6BfvtKPGWMFijfUvzE1i/1I6CXiNx3l55GUoSuHb2FsJrV:nw5hfvgOWycsLm+G3SfVLDbsmsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
MD5 95cd1581c30a5c26f698a8210bcab430
SHA1 5e8e551a47dd682ec51a7d6808fe8e0f2af39e86
SHA512 e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
SSDEEP 768:ntEW/l8F1+UoAYDCx9Tuqh0VfUC9xbog/OVHLlj2rUr2A:ntEW/lu1ja2L/rL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 ab23995d1bfc7d3955b51d13538578255b955aa057e306036b4731bf358a6e04
MD5 a71ed52df972d761ec0397d59ec12f45
SHA1 491cb1df28a6c960a1fb845580aa2ccf5eb7e76a
SHA512 fe061433908910d7fb2fe1ea59979dc869d33f5c63ff5699e34e6dfa435f4878d188290617c1fcda821627f41ba3bc9ce2d1b11b56c9cf3350f49a34403681a9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 548fb8177ab4b275cd3115cdc9c94b07183aae7577ebdafb9125e4fcacdb53f6
MD5 2b3ea3460ded9b4875c8f9e204b72f5f
SHA1 15c979036912f0748152b64a803047d672a9fd81
SHA512 069cd57a01b09aa27e9c2b19d2bf5b84fd369756b252040e7b2930ec2c4189077cbf3272f825a8fe76619860d6d428126095c7a090b911e51cbf7ccdb8c25ace
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58d760.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d760.TMP
Size 366B
SHA256 d24b3a57ce5596399dadb0a75e61462683603d3840c1fbde08788a7ca1725f71
MD5 659ba99dbb8ddbd0f3e9205e6b22c401
SHA1 3c426c71c290fae7db6103a93677b04a960e4d94
SHA512 3ff92c0bcbfac2a4b13049b6612620ef8b6608c2c154456836b56ef82bde3bbb4abdd296d86b5a5822eb3bd4f104ead8dfc7af4dd33ce558c7d267cd21de311f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d787b6ac48da0948a2669e95b2f7af99ce43e840ad7bb34400a56fec7497a6bc
MD5 e231be44565157e645a25623c3664afe
SHA1 53572b3d08f504337800b279c827440930167575
SHA512 5333225142844945d0383ccf4328b4b8e9bf49ab05cf2d4898b5915eae7071f8ad1d33658364c586e639bc5d57ba5095afaebc76adbd6a66bacc52f07f0ae100
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAHfcGe2RUmvZh/RG3z2OMi:A9iIxuERzA83h09RZxYyEIjvHRGaOMWN
MD5 SHA1 SHA512 SSDEEP

Submit Download