83b927cd60c3c3f6ef2d287666367bdb8220f98a92603ad72021def68fe0fa73

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f768c19c2c59c8314747bf4c053bd9d_JaffaCakes118.html
Size 174KB
Sample241008-ejv1ka1hqf
SHA256 83b927cd60c3c3f6ef2d287666367bdb8220f98a92603ad72021def68fe0fa73
MD5 1f768c19c2c59c8314747bf4c053bd9d
SHA1 a68b147aa94387a87ab740eacdae38b4d06d6d59
SHA512 bdc171b01075f63e38042802fb411132cddd017ba1f0946c9e117b9634647f3080edd85dc14a3b69a39a658aaae8f529eaf2c145b4617e948b8ed4337dd511ee
SSDEEP 3072:Q7GH5nzbslDHjfkKG5soQ9IPUQnj8FmvC5JXeDFdYV0pEFfs2nYf5WF60mSOXvmt:gGH5nzbslDHjfkKGa5I41zV+cuRY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
2112	msedge.exe
2112	msedge.exe
2392	identity_helper.exe
2392	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2580	2112	msedge.exe	83
PID 2112 wrote to memory of 2580	2112	msedge.exe	83
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 3956	2112	msedge.exe	85
PID 2112 wrote to memory of 1936	2112	msedge.exe	86
PID 2112 wrote to memory of 1936	2112	msedge.exe	86
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87
PID 2112 wrote to memory of 4312	2112	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f768c19c2c59c8314747bf4c053bd9d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e48d46f8,0x7ff9e48d4708,0x7ff9e48d4718
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10191888977135122449,8437667332907041997,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 6f40edf0d49abdaede7a47beb2eed9c5d097ffa348669b75ffb75a3a956e16f9
MD5 e9cf68f2a543ccc4ba8b4f5db12267f0
SHA1 05dcc53049375e51b5e2017e004c302f342f0433
SHA512 5864102351a49eb4037c9f7c19dd2b932f5fa0753c9cbd8da554542868d61c075a141407857473f709add92acfb0d9c3f91fba4860436b8268e2b541ed57d3d3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 752b1e277baa583b383709b8ae36fbe0318f43de94123293a1e5abcd9e79089c
MD5 ffea8e8740ac91dfb61c8c620123204b
SHA1 20f1d571926ad9b5e8ad848f97b1951500ad4ae2
SHA512 a40076ec125ebb4345e655a550c3564518dc2c620aa445261d03c0c0d27cf7a2e9176d8ae45db32267a3d981d9cebc1402a34b2fb6491cbf15958c6fce713a72
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 6c30784ef2eed64de56ab6011260ae590c018fbc3786010f6c5e9d7b9414eff2
MD5 a42abf0d71dc3cfe7cbf8b4ded893867
SHA1 c5fd6c9af637f401daca5fb42f49525793292a51
SHA512 a25ede20c60a7efce91b2185b715aad55c63b0f15326ceca7fac132a9e7afd623b3f11456dbf044b521c138247db6c4c0a2add8e0042fedc08eb6002e5ccd2d5
SSDEEP 96:npkwm1pmSwpvWMoiVmdeBeVbfpw8P8GxqBj8JUWQyV+VD7AiEwb:npkDrtGWMReVbfpw8PLqBcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e49b44ab0d8b4e17403a862bbef6463929aa4429cd0969332c47dc4d1ac5d595
MD5 70d018922a23adb6b674e133201113b2
SHA1 62ff4fe02692009a11f11a42a97f8f653ad99793
SHA512 7e6db27a738ac40c890f9f9d22ade85cc29a0a640ef5927a9b2152e8cd4ea2a77825dbafaa3b4f658115b754bedd97e3e6add9db58ec73278f935ccdd2fad0e4
SSDEEP 96:npkZm1pmSwpvWMoiVmdeHBjsJUWQyV+VDCziEwb:npk4rtGWMXBkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0d7610ab812ba9b4b2d70deb429073c60b30798b5485cf50fd115dc9edfb5e91
MD5 5abe0965193f3ffc7a73e5a023e4689f
SHA1 3130ef44038d29a152fa9a50d57dfb2dc97383c4
SHA512 7126bbcca6092753b276bdb8d21f894da8a450f0316ed9fe25b74f3100c0f395f530e7c3f5fe780aa9c2dde59aa64ee1d3e132a1aad4a4788155d75d86f14962
SSDEEP 96:npkMm1pmSwpvWMoiVmdeNVpT2BjsJUWQyV+VDCAiEwb:npkPrtGWMdVpT2BkrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 35d420992b04627c6978f025f0d7820e1481ab0b7755bd5f84a5d98f5866761e
MD5 efc228ade82a07174197ba59563e0796
SHA1 16e2c340616ede206cdb29f38becea8601c27966
SHA512 e5b7f0dcbeffa3db883d33b2c66fcba04c9477b8e88393fbba3fd29ec078d3d881ec1035e2278f670cbb9b1195349e0b537361c558e2580b708ee49f1895789f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5846a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5846a9.TMP
Size 370B
SHA256 6f945b9b423aa39f35c6233b5d159b8807d77ab60143c273d8847e31ce8615dd
MD5 23323751527ff43744fe9218a9fb6bf9
SHA1 36d6d5c96c0dbb417d24b3a5d80afe9537efb22d
SHA512 6d018ef6f0c4870d7d22a3bedd6e01ca5374d437bd43587f2bf18c0f48f2aae75850c9a91d6980db86c6f3628aa59c9e87e560c51f253998776818044a9a0d63
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a0b98599f097d5842874c1b9db33629ae49cdeb8b99c09f35125b4eef913bcad
MD5 0871081aca7778a9460a9d035655d3eb
SHA1 ca00ff5dd73e23725c7b23d49e4beb92218f0a73
SHA512 758b02ba734ba62d862efabcf381d58c1f8ed702cd252b3f0813c22b458b64e500eca5c9f42b8f1ca739b95b8b2ad00e89c8ea94b96c82ba4f9475c417d613b5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRRe2RUTchJ6+B1EPnIu:A9iIxuERzA83h09RZxYDh7bEPIu
MD5 SHA1 SHA512 SSDEEP

Submit Download