2d2b8a48d05791c86cf5ddf0532f4611fa0d60c627d52bed63a006eacc52c23d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c41990300685da6a679df4355a56823c_JaffaCakes118.html
Size 299KB
Sample240827-a6f3psvajd
SHA256 2d2b8a48d05791c86cf5ddf0532f4611fa0d60c627d52bed63a006eacc52c23d
MD5 c41990300685da6a679df4355a56823c
SHA1 87527e5fd3cc792d5cc7650b96d150cd9425baf5
SHA512 0842fa83138f1492227386fc612e9563b1540af738fe70e5f265a8fcdcf4803138f94b42b8902a2b18cde081b605b7c091f59fc4046a186033aa119cdc53900e
SSDEEP 3072:2ZcF8znJ2yQY8/g8SrytgSWm302HlDNFK+Hz2gr1Z/NO4C7m3yt2PadVd8WWUV0w:unBQY8/g8SkytYaz1vZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
2664	msedge.exe
2664	msedge.exe
2192	identity_helper.exe
2192	identity_helper.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1140	2664	msedge.exe	84
PID 2664 wrote to memory of 1140	2664	msedge.exe	84
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 3204	2664	msedge.exe	85
PID 2664 wrote to memory of 4716	2664	msedge.exe	86
PID 2664 wrote to memory of 4716	2664	msedge.exe	86
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87
PID 2664 wrote to memory of 3280	2664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c41990300685da6a679df4355a56823c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd790346f8,0x7ffd79034708,0x7ffd79034718
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10530301559248688318,1891193063904548416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 719b6c6e27f4aa83746a73ee1e2c0c753ee064fc37a3270ff8dfefbec3dca7f6
MD5 2de612ad1561b1becdc33c35b5c68cca
SHA1 4b0f9e62d2f53ced95c68e9fc7ac75bf3c2bae45
SHA512 1405d774c009cbc209b08a519843f7704be0182202fb60a84e2e9088d58bbad4c5af5d2b88280bb7b4f39990a63fca70581ef8e51ea9cfb3a94145412bb981cf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 8a26bdb63166c8917b6c513e9e0c2ec2ff8b9f35f13da58c235107c068c85cbf
MD5 b0eea211a4f888fb9e3e20414ca59c34
SHA1 5f0f837f17ef5e87d93350173983af9b35bbf4ed
SHA512 3b6d51df0faf7f3a21589b4c45085e03821fb4a5b6bf875b56592731deef15275ad9615e91cde22fc4bb0e24394b737c0265b17eae9cdf2491a24e57f6eb8844
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 99ec4684286c259eab0cfd38439a60861f01062cca9a13cb4f6ad74a9a53cb26
MD5 bcad08549dda81a47459610f4fa452f8
SHA1 4986aee73d9bbe9aca81626b2947b9cb4bd482d2
SHA512 04a1f2c832ee90c4d2a9f7b230fe2d4136908ab087f66232e09fd2dfc9335c32f2e482942fe6b85edae3ec5b272d5f036ccab522c35abe3c6ab711eb4a6cf070
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 126a25036be980cb312e65a232ea528b9250fa28c990becfd789b475751778ff
MD5 5d1bb0352bd793337db670f646ea3fc8
SHA1 30f5d95b16b15cf7c78d28d13dc2f6213de87413
SHA512 2856638ec184f31dd91a4b1abb4e8d2f77a2b19a3d26442676f5d026e3856801c668c49828887da8618da60409b60acdbcf264fdde7520e30f3a5593a080c705
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f5072aa2de5d162bf1de68e911ede3da37da9a892d3842f9eebfcbd0108947d4
MD5 88ff21b9c1cf498957e011a4a599cbff
SHA1 600cbd0d4d7c1d5e5993fde25e90d906d2732f78
SHA512 998ed6a39d1b7f04480631952414c694c8a6b4696e7065f3d86da7bf69d3943c8f219fb48d5971d75c73723b538ade57c513c5deb84f0a8b2e6d168b9c38f048
SSDEEP 96:nfkRFS1skTtwpvWMoiVmdeHTbZPUWQyV+VDCziEwb:nfkRQK6GWMX/Rro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 53a1d79abcc985f1bfffbbdf0b60361e54f3c9c92360559ebe3d6572c96f8e06
MD5 760019b9373f959edff3e40127e8fc5e
SHA1 25ede2850385c2e7ca5e29218bf513a7d44c749d
SHA512 26da48e3393c8847501bb26ae434314f105dcff9dd6add6a008f4dbc4e9a986a3d64bc4b7660f673eec709d2a87e8830980995688e79c539aa2ab8d8cbd194f7
SSDEEP 96:nfkRFS1saTtwpvWMoiVmdeISiCTrqGZ8G6Z2TbUPUWQyV+VDCAiEwb:nfkRQK8GWM4SiCTGGZYZ2/qrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bc07c06e92e19825aeae7fa728d08bb374b1403795bfe80d32a286c51cbe4764
MD5 c3a67a2271bfa476183ec31fe9d5df4e
SHA1 e63482a071808797bf5eee302bd3c0ee16f1a46b
SHA512 830bd6750c091ce647f63d565ad2710797e5975bb845a8f550728d247bc0a97afd7223d5afeadbc7437d3aac4e916aa64e6e76dc532cfa972e4fecbff02b38fd
SSDEEP 96:nfkRFS1skTtwpvWMoiVmdeISiCTrqGZV2TbZPUWQyV+VDCAiEwb:nfkRQK6GWM4SiCTGGZV2/RrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 977a25c719e25e303d42d66820e11e55346cbdff8445fa118e09bcc80c0bd527
MD5 15f7f70affc2336034a59fe37a41f74f
SHA1 a4b5bdfe1c366e02544b61f1f0aa86e646224cef
SHA512 950d6ad50893a72e42906a8084d1c15bd6a334cea90ea1515afe308fb7f38dc860c06ddeb1be790e8213a181dd28fac2aa21f728ae28df1729529979081aafaf
SSDEEP 96:nfkRFS1saTtwpvWMoiVmdeISiCTrqGZ8G6Z2TbUPUWQyV+VD7AiEwb:nfkRQK8GWM4SiCTGGZYZ2/qrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 1363fff0584cd35724ba84e12ebbea1c3e41d19208836bd85d107676da45bf72
MD5 c72a621bcdd70e84579b33919009073e
SHA1 a9e8d43411433855691374e440bd656c78a62ccb
SHA512 f095321eb1101f6f61993093cbef33991a55225830864c2796ff3f92f5de7642e3ba6976048f50a6e47f59fd45fdf5f056a73ad086ae61f4f020ebccc24a4f48
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58d7bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d7bd.TMP
Size 203B
SHA256 2405ccdccb7f48df78f2f029a5841424e54313d361a759953529f3eaa1fc49d6
MD5 0fc371dd1a27d3042557c19157323218
SHA1 597b4b66322b82b9de36a823dfbbbf0aebe3a56d
SHA512 7d2d5dc9971cfcf9ca762015c6e5369a56b6016e9156eb6ff731872327cffd9244a0b4208adfd249ee61e569f072fd3980c640f7854fa0a22b1eb5f6fbc4efef
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5105fea3a06fb630c68e8cb5e7306df98d5f4b9846fa39a8ecf40d3c660912a4
MD5 b6d12fb0b78bf8c3616d55107f1aff67
SHA1 2b9da0e0e99caab2b4fa3e9a3981c9c872eb8e01
SHA512 429699a07c444190cb786b876f2a4c958ab764a968d83307d158d422792b8f5c18e03096802f80bb70585f373f4b2374075397db2ec7f53e07b9a0d39d49daf7
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcXGe2RUdkjbRw5Ytj9ZklE:A9iIxuERzA83h09RZxYcXIxckLsl3m
MD5 SHA1 SHA512 SSDEEP

Submit Download