953931a8f26492b5d904935b63319a0a0122bdf45f4edc7f57bb67ea071448f7

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b8a09481e8beb3e609be73f9dd96b7ad_JaffaCakes118.html
Size 62KB
Sample240617-pp388svdqm
SHA256 953931a8f26492b5d904935b63319a0a0122bdf45f4edc7f57bb67ea071448f7
MD5 b8a09481e8beb3e609be73f9dd96b7ad
SHA1 a6bca1fcc5b71efd9aa30d37ec62d9fb3d6d9ad4
SHA512 10faa13a816d16977686780ee82511b0bc2edf1809f54e043a93b6d54228645169d3dec0cdc0e6591ad5e5453f270330c0aaf270dd158cecb71fbd5ecaf9b4c0
SSDEEP 1536:71FYcpRVkJtCg+798F8emaPk7yGbFXe53pEdtV:71KcjVkJtCg+7QrGbFXe53pC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
1844	msedge.exe
1844	msedge.exe
3464	identity_helper.exe
3464	identity_helper.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4868	1844	msedge.exe	81
PID 1844 wrote to memory of 4868	1844	msedge.exe	81
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 1864	1844	msedge.exe	82
PID 1844 wrote to memory of 2036	1844	msedge.exe	83
PID 1844 wrote to memory of 2036	1844	msedge.exe	83
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84
PID 1844 wrote to memory of 3224	1844	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b8a09481e8beb3e609be73f9dd96b7ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd08de46f8,0x7ffd08de4708,0x7ffd08de4718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16753436014002090760,14716353793909986114,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 432B
SHA256 ab267a037361b1053b0b2254888c6937f2cee293babc3c7bf536a68b7747e328
MD5 a26f0776f4ac8ebfae8111bf0fc60c36
SHA1 1107b80c8f3bf0243866c171fd8013f183b34ed3
SHA512 c9e49009189925f402d0a9821d95c8d5cf6fea6b9ff21b19ef8746437698fbd0543d05bd08a21fa74ea466fa62b58533c5508c8c9ab94fd745ff146a599b2421
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 b02f22e0ca5eed5a652e86ee32215b3523092c8ed88b94eba479a0ed9a67c1e6
MD5 8b9f547b4f2238c02b8e9daf5874d5e5
SHA1 e8d72d8e2025f4227a7063d6bab672544e8ee0fd
SHA512 af2e37eb7dff8dd0b2de75944fabe8fe45ed87ecf5e6e22a710e7458e3365f94014f45405918041f098ae9189d1863f24c6d7b0449bacc1711a52c4a89970388
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 146423434dfbdf11a64ecda0a718ad4f7b0e099278bba45e353cf1adec174c62
MD5 f45dddaddf2ca581ec7ab9e24ac82033
SHA1 6432a9684f62f2e78871c754e58c6d752c565d8e
SHA512 9e60d4f39f1e7f989b42298ca5a4b8440af2bcdda7ce3df4a3c145fa2e01dff26338d94f6875c394f42d8256a223816e6e0910b2cad67423caa4f0feba583edf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a33943e5a87835b877a220979a36943bc876432236573dc1933302ecde18ce6c
MD5 ce6793097ee5ed84a0e43beaf1e5ec4c
SHA1 598d9666fda7bef8f6e60b05811361ef66ac019b
SHA512 b06736ed3a066b8ac27475071abcf1cb840703fb5ac79354f90392b3f26368f94ddf4b7a17a3ad1fbe22f2d8b11accf2f898cccb638906dea404f82aa1815f90
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 672fb2ed80b6662611778fecb2733c22cb689df1fc2be07466131bcb012c8a0a
MD5 7aaee05c2c82ab4daefb98730e420eb9
SHA1 4be4562cd8e1c2baf3c38f2042d6cffc8343ee9f
SHA512 02fc5e716c52a98d88b4718c5e6f82ba4d4df2521d9936d6553dcf9bd7d5854d27b88fb658e996aa49112075e77729db495c70eb1b06706967b75cf569832b8f
SSDEEP 96:nvkVoxm/DQYmq/1vVeUwwpvWMoiVmdeHIqQCg/UWQyV+VDCziEwb:nvkfIwzwGWMXdbg/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f2fb35dc10a02499433d1ccdd38c2e1ee4c9f7cbe6a4a3e27c1fb2538a42286d
MD5 406354c215501b0d49a13e116cd116aa
SHA1 5dc03809c5a3295a5d8fb142c38c8b6e3db7cb6c
SHA512 17e1405e51d56ff73284ebc7593a2a2f8afaaa71e4caf2dcdee5e72d0b23eb8c9437c56a83f41c1083791307e621eec72ee2edce27cc4f17006cec39217839e4
SSDEEP 96:nvkVoxm/Dnmq/1vVeUwwpvWMoiVmdeSqNoCxCUX7Da2IqcCg/UWQyV+VD7AiEwb:nvkfCwzwGWMiqNoCxCUX7Da2dng/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8db4d5fa6b539921a1902383e65e08306d83d487b13379496d6b84efb146d64c
MD5 5f0dd9da634fd05b15efff3c18054199
SHA1 a6b38b775499e76670d0e182168ca973a22e61c3
SHA512 deeab446074852c7ff7aa9a1a276efa6a00df4909992cf8eec0fd75ef50b4ea66063e7ba591e3e27e83f799fb090217933fe857fc9250ce66886f7a69c33b594
SSDEEP 96:nvkVoxm/Dnmq/1vVewwwpvWMoiVmdeSqNoCxCUX7Da2IqcCg/UWQyV+VD7AiEwb:nvkfCwvwGWMiqNoCxCUX7Da2dng/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 07927e6f0c68baf73f9e954984dae4276639cc87860e7aa852c232df5f5bbe9f
MD5 38f2e55f5f687297e18fe5988f1e8c48
SHA1 ee64d7c2f1241285d248fc8993d64d074e7232d0
SHA512 5c737909ad93aecf7ab3a7b72ced7c1e8bdaec01c2c32346104479b162cab73f99090b32ad2380245aa0eacd0bc60454cd9656a8143e4ba4ed18a97722235dfe
SSDEEP 96:nvkVoxm/Dnmq/1vVeUwwpvWMoiVmdeLNoCxCUXDa2IqQCg/UWQyV+VDCAiEwb:nvkf6wzwGWMbNoCxCUXDa2dbg/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 b8f8991a64206b6b6f834eb51704fefcd6954d4022e973fcc115bdb17200354a
MD5 78bda33a03837087ceb7bda63524d8ba
SHA1 81e070011e685cce10a0af889e5b024f23e1fa96
SHA512 4fd8e59898af2b7018ce053c8501316370cc3b186d7780fa17b243a21a7c616daff8622a833df041a8da6b98d272838150c55ea290f6e08c2866696d7a91c259
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b9da.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9da.TMP
Size 371B
SHA256 881ef27348aa6ded57ddbd735adf719609cd98f64d1b14e52b3f97d961a2f56a
MD5 c9b0ebfb487dd1b7a968b0800dadb99e
SHA1 163b5e867675b6799ae9bb6933c62b45a9821816
SHA512 b82f33f042042b750cfe8b0c4ec9e31ae7a7e49bef111ba782ae5bb9e9d621ee564fedfea6ab0066cdf21715591691f94421d682847369d9300791cf82806a12
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8f5ba76415f626c3facc2f18a730e36945e3b2eec3bbd1dac0289267d8e5c341
MD5 5fd6295522795b03e02980e50ed4bac3
SHA1 31a00bb0895c1a38e237657b329bf2de520e25e2
SHA512 c9eb9116d49d568b09b9f3ae15153db0d067a574ffcbe6fac2709748bc61a5a7af9ea902caf22693a23e7434764d0bad3045901c823588be8f401bbe70aca588
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupqp0Ue2RUZdvg3z2OMDCRHV:A9iIxuERzA83h09RZxYtaggaOMWRHql0
MD5 SHA1 SHA512 SSDEEP

Submit Download