e21e32449ae4ab2d60cb692028e5d7d2113b0005bfd96511cbc9d12bc82df7c6

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f81a58e9147fd4ab2c3831a0ffae49b_JaffaCakes118.html
Size 113KB
Sample241003-tf3zbstemn
SHA256 e21e32449ae4ab2d60cb692028e5d7d2113b0005bfd96511cbc9d12bc82df7c6
MD5 0f81a58e9147fd4ab2c3831a0ffae49b
SHA1 c8e8e3b3c25b78441fd563176c4c4db9f2f38e19
SHA512 c8c66ba9094fcd7d21eafe77a19b0b090a2d26e007c2163979cdb6b051948b0ecf8bb2e9da5df100a0ac13ec3b4d1d9c57c0026e4a9ae86a4b57d924873ac65f
SSDEEP 3072:zFzqbIrqbIV9TLuK/dVPBE2cyItAch7EAhNgZNbk:pQIIIRUAcN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
1640	msedge.exe
1640	msedge.exe
5068	identity_helper.exe
5068	identity_helper.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe
3836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe
1640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1604	1640	msedge.exe	82
PID 1640 wrote to memory of 1604	1640	msedge.exe	82
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 5116	1640	msedge.exe	83
PID 1640 wrote to memory of 620	1640	msedge.exe	84
PID 1640 wrote to memory of 620	1640	msedge.exe	84
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85
PID 1640 wrote to memory of 4004	1640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f81a58e9147fd4ab2c3831a0ffae49b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c78546f8,0x7ff9c7854708,0x7ff9c7854718
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1460392909227679942,513624564678231686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 4b544a4ea1145f68ba0552c412e2b52a9a250dce50002adebc242e11799d48e3
MD5 533c9ab4287c0759cd7138b63b394421
SHA1 8d8d5f57103a38801c290ca046cb0e3eefdb542c
SHA512 4663a6504f48a61aeb5ea87525bead4941f9f7864439f32b62ad8d1c0eb6cbb1c6e94fe1e7ea86120cd29ffcca8f1e67ec2962df4226d52b7e29ce492e756f7a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 aa87e9664febd11a3ac9fdb7bc20f0292a436c8f47a222cc06f3213dc0ce1b54
MD5 2e22eb45d86b8e72e7e7c337388b0c2f
SHA1 5df64ad1c387c42f4dbd5b01b5dc7923ff22d805
SHA512 c0888e653768807a678708e05f64f37a75a9e4d611ffe00157a8195590f2f48fa98ad87a5b836c621d5a272ed2ddf3d56b98a41e1e6cb6a2b30c9771adad0006
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a7a6394770274dbf187cfa47cd5c0ec46dfb799946c781fa7db6d421cd9b4930
MD5 955486866b143585c7f2a8635c8ad2b1
SHA1 2ef3f1f00213c61644bd1f9e91c7cfdc119f7bc7
SHA512 42285c1ff875bcfaeb405ee408de1367571e90e7c95456d9f69318a9d81a40a2adf7ce8ec7414b4e5120dc2f51fe2dcc49918d7cb1b78c81996d5900e13059b7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 689d509ada9c3787db3fe9def39e0d7f99de3c57acf9d15f2b235aa1899d9d70
MD5 c91527a81cc5d1b2551e0727c187caad
SHA1 566243c6c0131e9f1b991cedfd0e0fabdc3d96d2
SHA512 6ec480f2ba84398c99886b1a01ecf29c2341bf1b7e97ff7b0fddd697385af695ecf93d281e200dce44b7dbbc728e739e3fdef4042a037676ccd9548a89bfbbda
SSDEEP 96:nnkXno1GxdwpvWMoiVmdecfipY0Yv9iR66XYXmKj2/dhY+UWQyV+VD7AiEwb:nnkXoYjGWMMfipY0Yv9+9IWKj21W+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4a9b8a01f1238f430cc6d61102f518b29f83630b60bc06f0c6069eedaee1aa45
MD5 08b589e836b4301fcdd962448eec2b93
SHA1 a12b96499c608389e717294710fc28ca88d64ed9
SHA512 170921b91c681bb829f5c0020e77dba7783a8ba406928adbb0f947709a0b713f6c141d3bb14954b4e026158915c563a1b191189c4369a33c0d3b2bdfa9690f56
SSDEEP 96:nnkXzo1+UdwpvWMoiVmdeH/ddY+UWQyV+VDCziEwb:nnkX8MSGWMX1y+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 edb992eab5453402bd6f0a5eae8d409c74c94e418fd661fe3cc41d0d8dec551b
MD5 a04a7399c4b1f06d14e3d30d4b5d57c7
SHA1 efaa93332128616b432d04304f6e011955b48ed2
SHA512 61404832d7b7194259aaf1cc49656970d8bef38c33eb3a173c6f9116ca5d4cb8952e2de7b3b45621c23ab7fc72f934a48a9603dfdbca3044593d55ec90578f05
SSDEEP 96:nnkXTo1+xdwpvWMoiVmdecfipY0Yv9iR66XYXmKj2/ddY+UWQyV+VDCAiEwb:nnkXcMjGWMMfipY0Yv9+9IWKj21y+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 cf8666d820e36f66d86666f731f09b2192eb4a06bf2b606a09ad2c891bb4feb5
MD5 19e83b31ef283d7526a9d97cd382463c
SHA1 8deeb75613ccc62ba2cc75203f98b59de680216c
SHA512 4f9174ced32556039fd32c7b7d42bada02a68ea07d49337b62880b2e55a53214feb6417e3c51051f9c4c2d86a824584745dd9e396860e43e6e326c3a8cf415d0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe594b96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594b96.TMP
Size 871B
SHA256 c0f54be351ef065cdeda5f2869bc4fcabfa77778ff0797725b753de312d82b67
MD5 cd425bb1b8e0eb5681b7d38f29352462
SHA1 9f848338e7c3f8c225d2cd1aae85274acde1ff58
SHA512 46c232154eaddf857850e0bb89ac11f07c5a8398675e94a5c650210123946c36e1d93470f50643152b02b9739c6d14bf3ac797ff39d8ff04150d30b41e94f1aa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a742e624bff280bb84ad5e8e6e1973f3cb0899e8f5c5c54eae0fad9449d739f6
MD5 e5c5743c6f3f18bfc4250b540db080ec
SHA1 6aa5418d429a3e4bd93392cfc7e3294ac5d58e8d
SHA512 b1fe4bc064e521ca02258dedc19a3fadbdc8a949a27fd9e1743d7bdc1c6a954838b2ea6a30e0ab480bfa1dcf4956135664a3a872a91c4c48894cb2177bdbe2ee
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZOLe2RUn2eIAnIcM/bo5Z1:A9iIxuERzA83h09RZxYYjrdqZxM4D
MD5 SHA1 SHA512 SSDEEP

Submit Download