e22abc9f74b6f52f0b6edaf36ea632170131594d4913dcfc5b59defc9cf17936

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9ae494ff0ad16f2d11c62d7250a3889_JaffaCakes118.html
Size 37KB
Sample240614-ppsgqs1arh
SHA256 e22abc9f74b6f52f0b6edaf36ea632170131594d4913dcfc5b59defc9cf17936
MD5 a9ae494ff0ad16f2d11c62d7250a3889
SHA1 735fd2b710815e087dfec5c1e95a614e3c7a7fc9
SHA512 c1a3b63338fe127ddb4099707fa6c39bac4400d959da74d375ad7ddaf80f28d9b21afb6317b172333579e78f28a103d57f03c11b0fe4ef4b49d59cc82b468757
SSDEEP 768:7FX7GPaRTyMSMkHeUl/fgf4kuHlt+gS/Yp06HI:7Z7GPaRTyMhkHe2of4kuHAYp06o
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3560	identity_helper.exe
3560	identity_helper.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe
3860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe
3692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2992	3692	msedge.exe	82
PID 3692 wrote to memory of 2992	3692	msedge.exe	82
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 4864	3692	msedge.exe	83
PID 3692 wrote to memory of 3676	3692	msedge.exe	84
PID 3692 wrote to memory of 3676	3692	msedge.exe	84
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85
PID 3692 wrote to memory of 4772	3692	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a9ae494ff0ad16f2d11c62d7250a3889_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf1b46f8,0x7ffbcf1b4708,0x7ffbcf1b4718
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4289161291023819072,1033112583791508026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 23KB
SHA256 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899
MD5 e1c71f7c04be834f5587230db2ad24b3
SHA1 f3bab9cb99d9f343bf7ed3981aaa7450515d2424
SHA512 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51
SSDEEP 384:LrvAH+TKO2Dci+FlkjrkWOKJepIhTZ47jmxKbHsc4VzhGKTdHn5Y0MlJacX9oybk:feIhQcf4fkrTpidOdjz4jGAdH6vPao3Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 b1b32fe8bb7f5c06b5aed7c3fe0d5a28440cdfe67941c49517358c8b524160bb
MD5 bf664c21a7c2d03e6c2d757def1d5bdb
SHA1 43f678eb443694e1acee1efe89d684bcf39618c7
SHA512 2564187ced4a6399f83e84aa49523a50a0869e6142f4ad3a7d5bb97f873ac426564f59c9983c96d2b07e686557f6ad5e1f1a497babe0072c6b95e3a53dbb4c6e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 c45edc49cf8365fe19ce592d2f353f94feeadfe0d0441dc9f994c164b33debc6
MD5 e08b0f2bc8b5fd9f494bc2eb99bbb61c
SHA1 2635fac2d2fb8d6a9e72636e86504eed062af136
SHA512 03cca5b6a76dd413a1c061a1d68d2fe0f00af394aeb47f18c5981eb12fce8e2f69a28ddec339868dde9e1d0888ddb6bc29a9992d7c99ce8c2b9c4c1fcc434e11
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d25411293693d68eae9ffb27826ee76c8c24a6464b5dc1b3c4cce7abcdd441ce
MD5 b60a0f50e7081d187c57799fece78492
SHA1 ea18d65d5163b6fd29473cfbd2f3122ace44d4d6
SHA512 22f305fb203d68b4b893130898ca53a6dea28bc2ac28e2b2c44dbc7639ede5c4c16739f6e75dce65d42af59452904ec5153c5871971c5b94f8858c702454b72e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 78ecfa94ebaab1a215c43c022d5dab2d613a83b41a1908df9dedc63ca183fa5e
MD5 1955cb97f0ec7461780b508ca98fa7ee
SHA1 41b9d636cc9f05bdf46ee56195460a99d196480e
SHA512 d88415685ca32a77ff659e8eaad040aba4940319ca869d18a2eef5fd83765ca0c4828843884f29fed3cb2e11119b0fe39cd50dd743b91773d4f7a53d74f3db6b
SSDEEP 96:n1QkVoxm/DnmqFk1rjwpvWMoiVmdeKDUNTfBpZuYKPT2LR22WfGGUWQyV+VDCAih:nSkf6h9jGWMaDUxfBPulPT2LR22GrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a6ad9a07f77234dbe6cd7bcb88dd2a9b9400edfc9930e31a107ef5564771c40a
MD5 3abdf53ce1fb69d4dedd99cc9c723413
SHA1 40de62b9d55ad57321a830acc0e323643699fb12
SHA512 a4d906b5b813cdf0762be50b23d74ee0bf59440c0b9d10205505ccb209f16c338bc700db167a5ffa3bec6206765f6de006b7300a45c10f752c6014188a32be42
SSDEEP 96:n1QkVoxm/DQYmqFk1rjwpvWMoiVmdeH2WfGGUWQyV+VDCziEwb:nSkfIh9jGWMX2Gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 221147b72be89eb32f0cbd674342fde589e5a31cee45c784e19e5bef70df1180
MD5 32137c7ef8238e9420357cdf795b78e3
SHA1 b4e6df166bf85659f3967f3da34456c6aa9655a3
SHA512 988adf76dc368752a3958d4efea2906cfd64f57cabece681064244c0840fddcceba356177cfc74feb51493bc0d86574dac500b43c342d6672ab6d373a1a8cdbe
SSDEEP 192:nSkf6hVOLGWMaDUxjbbBPulkCPTz52LoRn2DGrg:nSvVOaWKfVD3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 4600f7a25b01da8b2f88a837cfdac2fd3fc6080752ede0b271c316235952d1a1
MD5 ddf45891d4ed07984175eae5a97f449c
SHA1 6ead299aef65183cd8b3b6b559cb3d66e7ef1e6a
SHA512 a6d14186fdf3bfacef8977aa3cc189403ba0e19c9d8d9af16594d7a32172b852d6e8ead14291e34adaf678361ea2d671af5afafc76930243f06ee61830fb3fa6
SSDEEP 192:nSkf6h9OLGWMaDUxjbbBPulkCPTz52LoRn22Grg:nSv9OaWKfV23
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 661b8999969f7725e8fbb255e0bbf805a6a159cb33d0d5e1c2d6bdbd84e2dfb7
MD5 108cd51b8e64226c5fc63d0e79086940
SHA1 643fd2c9087141345c18ff901750ac11c1fca9e4
SHA512 3d5e83efec5a570f2d42a717d052e91e06b7e8553a6c268e07cab278f576c3796dc74ea2ab67505ea57ca9e5c3a13c3252a92c33c3d3381341be43411d6944d1
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b1ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b1ac.TMP
Size 370B
SHA256 09c2df0957815f216bcc5ccf1318d5f90870dd1e3adc9a5a3849a50327e76305
MD5 585a7fb1e12976cd41af7c590c5dc4da
SHA1 11fe66a080245b93c75de41e70978925018e5bcb
SHA512 974397d23c23bd33349e3935bf6e6b50f10a9731180a826b449a3f9c5c5daf13eaa2c1edebdd48633c5726f84c66f66b1d174806cf4f6f30aa453ab0411e233f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0c35282c3d043ccfae64442c8de2bfc15292c988d52de9ac6033a289e5cfa01e
MD5 718f3e87fd472e578817f05f7be3875a
SHA1 c700cfb9f459cdc5db23ab3f4e97c8da36ff74a9
SHA512 a6c3cf7c456c10d47b981d65536bb785d888fd43bb6c9b450bb7f78911b011aad35863500121d1dbd73bf9e794c254787c1b64233679ad8b11ebea6a5480a93a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuppHfSe2RUohQ/63z2OMDCRO:A9iIxuERzA83h09RZxYF0/g6aOMWRHqB
MD5 SHA1 SHA512 SSDEEP

Submit Download