f0cb3d30be84f1faed13b0d7633cb07f0870ad96a7801c4afba4579fbdca9737

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a6967afc5651c87e0a665f84521a5068_JaffaCakes118.html
Size 69KB
Sample240613-vcfkasxanb
SHA256 f0cb3d30be84f1faed13b0d7633cb07f0870ad96a7801c4afba4579fbdca9737
MD5 a6967afc5651c87e0a665f84521a5068
SHA1 17ff0d09a8bfd7eb7230c01476b32a2a95c173fd
SHA512 28a27418c0bd71a1099e1203abc0d97e00b967a984fc51f6f663cff6fbde76db11fc24db0e6697af7a25d0dcf86f525c39fbbe1bbc04be0343da4d96964d1347
SSDEEP 1536:Fo3N79EKdTpW4v/G6d+VAgr+JxM19zi7FNjtoo:Fo3NBEK3uSM19ziTtoo
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
3016	msedge.exe
3016	msedge.exe
64	identity_helper.exe
64	identity_helper.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2564	3016	msedge.exe	81
PID 3016 wrote to memory of 2564	3016	msedge.exe	81
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 3716	3016	msedge.exe	82
PID 3016 wrote to memory of 5104	3016	msedge.exe	83
PID 3016 wrote to memory of 5104	3016	msedge.exe	83
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84
PID 3016 wrote to memory of 2576	3016	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6967afc5651c87e0a665f84521a5068_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e4718
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1956 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10739423050828654561,14156585341694452656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 0c049de7daf52f606633d7fe6ea0cb8aca0afbf024e84f4fdcdd8bd1847da3e6
MD5 58c774f3a1a644b584ae61c617bfc04c
SHA1 cc206714b6e03cbc01ce38b86f0fbde10f14c09b
SHA512 580d7b4c1e1a610697ec07c1a18f79b8737554fdc23de443b2718a332d4fe96d2a5cde52ba9166477ce46719c9dfc80ff042678082f53867f1f855d1f529d4a7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 463f191b933612402e398215a027e3fb9ef8cca2cf251721dd88f3c840302e76
MD5 b842805fc596d5f3d9bba5c6e892bdcd
SHA1 751f4a60522da6067d954566aaee441290de2f4d
SHA512 b98b08a018bf84406fd7dc2f76a919fa6522338392054df56c8e6aa3ba7a085fc84b495def5d9cd3886fc257c63bf9ad757931e60ad61023126695ac7af72f4e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 501cccc3eddbd3016037ef9eeae3fb6c5dab8c309cf66557d75dfcf5d521496a
MD5 4b689c516f5dc97f806acd3d99a06ca9
SHA1 d480578ee0072aa8b518bd06e595a526212813d3
SHA512 ed416608addbcea46ac94eb22210c6886d81032857fd27cab7d90f6c8ddfce720e837021dc1cfb1a416757a832e03e9df1b07ec080eb954955d988852a8d1753
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 431e0bb6f0b72e86a81ae3612b078382743067278be8c464c4dce2eff4fe533e
MD5 ca36e7e10b4290a5a7994dc1e3d5dd39
SHA1 a15c88d5d03e45d5439c127887df78c77a745fec
SHA512 e2ad179eb1705506c0faca0b6e1b66cc7fe46946be24544f3b17a7f94e6871d0ec8f3f8036a106a891e3f61376ef1530801ee765e3d039ea280b84690e594666
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fb27e698da1338ad34338258656b278804ab8621b14208aa8490ba484c2c08d8
MD5 23d39fa33f0e2d612ec8d1c2156efceb
SHA1 68b9cda1edd65d5cb8ae43cf5111dd2c71ca0397
SHA512 6a46d8169b5c69087afcbbd1b32bf0834fa2b4032dc863842f2f6ae4cabba4d935ab86931a28111419d658cbd6d5d0851242d2b6ef50c280564083fab7168540
SSDEEP 96:nGkVoxm/Dnmqa1FYwpvWMoiVmdeHIqQBcqUWQyV+VDCAiEwb:nGkf6B3YGWMXdQcqrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aee56087a032480d7aebc1f271202587319e7705c379a442c6814011cc049a94
MD5 62d2f7df5958de80c580358c308a7b18
SHA1 12996061717d8641e1db1a309793ce71bf3856c1
SHA512 b682747824ba6ae51e1d6e7f4c638d84b9a468841389534ad5e0aac1aaae58009020b2b9d10a216cead6a9865752043ee2b0661d529b46c561272806a06ca327
SSDEEP 96:nGkVoxm/DQYmqa1FYwpvWMoiVmdeHIqQBcqUWQyV+VDCziEwb:nGkfIB3YGWMXdQcqro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8e03f0382af9430e9789257dc6d2650eafc6341f91422ba4c3292af8a97bb4fe
MD5 976b90584c30f0fde82fee5763997a29
SHA1 81aec4d3fb5e76a4a10296278569a348236e5e98
SHA512 cea181156981f73ebb51295a1c81c94b13d76fce7dd89d0637df11455762ec9a8bd922857372a20ae98144a29d359c24d2e2c0e79a99596b6dae45711bd28c68
SSDEEP 96:nGkVoxm/Dnmqa1F/gwpvWMoiVmdejGWqIqQBcqUWQyV+VDCAiEwb:nGkf6B3/gGWMJqdQcqrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 767727d4827f42fe42580d02f192a8ca967dfa126071534ec2e27a24281e22dc
MD5 8894b642be7d2b71ad3f946bc99ca2fb
SHA1 b791513654d60b3ce28718ad60c5e27f9e406188
SHA512 1ec5a9d2a905c7b94e644878edbc8c8cbac5967501811feff147d2464ba823e90da5b9e77a82e773a99792291505897a0e3d9009963158305931c57fc4339e36
SSDEEP 96:nGkVoxm/Dnmqa1FRwpvWMoiVmde2VIbcigGK5FtYKDzKdoGKeSK2IqHBcqUWQyV0:nGkfCB3RGWMEklqXXcFn2dhcqre7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 f7e71a668e7d54594fe64ab1145189e749e929251e3f8f397d3db3acc93930a9
MD5 0e08dfcfbf5c8285e84bad00986ac5d4
SHA1 77809fb3e0c81f616d70ceb057bb072b8c6e58bb
SHA512 c6cf636347b95de4a06238159afc5e576d05498cd6b8886505055be52d5bace0884fa17f27add43e03178a9c9eb6cebf2075f068e1acfdf117e7913cbc38444d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 6a343a7766fa20231f4db9499e7c3cc4537940e5c6029dcb2ae4b21f6db3b75f
MD5 100fb8a6a57fac4a30f7de9211194735
SHA1 c14bd74f9bad1247d1014f6011528195a8caf025
SHA512 29771fff839c4c59ace01f988a46112b36f2b7cb468643e740012d2b67740b2a7b3abd7e4df758651ea1e9a74174e499df75eac49d7dc6e3e8ee044c41d315c0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ba38.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba38.TMP
Size 203B
SHA256 ce6bb7de25600f705ae7bf161b74a4a82279e04f596dc5b3149a8bdfc8100953
MD5 4591e87337e652afac17fbe2fe21dc33
SHA1 fc04e16477f603933311a46b2fb6d9f129e0ba45
SHA512 0beb25a9437d5a0651c78a29b893024721c8c3123e7e21d6c932ccd714cf1e91f83fa932fdc9744eaa24c1f34b94040f36cfd09b838176d27450033c58bce014
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d22467e8176a73da00d6a800868cb26e651107aaefdba04c4e5b371b82970aa7
MD5 62a6e3494d3f6d5e04a7baa2e6f9a4f6
SHA1 93406660f9153096e77faf88623f319dafa47399
SHA512 3bb11ed474c75a1473c6658c7217cf56676a64435a87ccbb6aa34086b5d58c96369057e851f1f06ccae44f9af94c3dff6dcc56841aaed5d15dd62535ea14b40e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLYp0Qe2RUtdvK3z2OMDCR8:A9iIxuERzA83h09RZxYLfOcKaOMWRHqP
MD5 SHA1 SHA512 SSDEEP

Submit Download