6e2d9f0fbe90cbf43b46ee85d6d437f71f85f7c1558fef98cc3b8a5022ce2bdd

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b8ad0432eb750fe51d03351a1c2c749_JaffaCakes118.html
Size 151KB
Sample241012-xftmfazdpp
SHA256 6e2d9f0fbe90cbf43b46ee85d6d437f71f85f7c1558fef98cc3b8a5022ce2bdd
MD5 3b8ad0432eb750fe51d03351a1c2c749
SHA1 eaf1c09dc1dab8711c91951d0063b8c1ce519c17
SHA512 4ced51f8e3533db1aa7d44ae0a1fee0ad21c67ed2c18fe5555a1511e07c22fcd1363a6301e4bd817202991e44683651735feb48c04e2b76daee6cd6134d9f120
SSDEEP 1536:hmJEEJXFRi/gDevYCjanDD9BVZfkjnJKlf5wrw+iB:hEJXri/cOYCjanfVZfcs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
3428	msedge.exe
3428	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2396	3428	msedge.exe	82
PID 3428 wrote to memory of 2396	3428	msedge.exe	82
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 756	3428	msedge.exe	84
PID 3428 wrote to memory of 608	3428	msedge.exe	85
PID 3428 wrote to memory of 608	3428	msedge.exe	85
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86
PID 3428 wrote to memory of 5096	3428	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b8ad0432eb750fe51d03351a1c2c749_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc822046f8,0x7ffc82204708,0x7ffc82204718
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,521045517627269193,12872576589738404547,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b187c87722cb5ac7c50d4c3adeaeae6dfabe3fef69b20519e53710ddcd8281fa
MD5 65d72337a57f9cb562c423229d10c526
SHA1 21c1b8eee4bcb5978a5ee562e726e49ff86b3723
SHA512 0aa27e4d01ee15eacc014e9fb8e9f642c4470d3d69bf45fb3f5579d6dda45e1c6a9a9bbf170e2ed705cf87c1c90bf205b1a87633c678d6f02cebeb619e632352
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 258769f030e47d1c32b76cd11d4a408285ba9ca818f96df178488e6747f5235f
MD5 be83f096012174559f7abeeaeee7f7a1
SHA1 3da2f4a3f84d3c6b24c6e84d2a2b8f339e1b031f
SHA512 f54fdd34df8aa3a8633daff60b37a463cb4cb90f21de5655a9cd2d2b180e5416bf061fcedbf366c555749b8e395313bf05716ceb020f0a6401cc773bce016378
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c303cebdba6c500a21464880ff8662590c23f911c33bc62b5711bc3b3f267e17
MD5 984ffb1bb218baa255df6c2cccdd1e15
SHA1 18bff08fb83e7a5a56758926ad9e66c86bc0aa98
SHA512 5633f2d6f3f69af1a85199c0f91fb476e2bddf4756a17ac8e5606fa195619311f936ffc61def6c62df51ef7aea942ad0367c31bf1047798c16b0953a9fae7b3f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7b5b2913b88a32c2994e430cb2b9211ffd94d0012d232e8279a9a9f21fda184a
MD5 b7fdae148f8be0b60effedae1f4bda00
SHA1 03c598b2651c8bafc246b09fc90017b2681701f2
SHA512 1a02307de44e959fe8888f779a41a6bd8eecc5dade633474db0912fe8bbc84778d7b7824d59be21257c6b1b0aee2f26560ea8b3cd942752db29b4a199a41a5f6
SSDEEP 96:nIkuxm/B6mqM1F1wpvWMoiVmdeceANuVgdKVy+De2qZqSIUWQyV+VD7AiEwb:nIkj/z31GWMMeANuadKVy+S2NSIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c0cd725516f2f619f6dfa294dce4c4b89a24053cbc47faabe10508eeab701ee4
MD5 225a0937146c2ad3915f44abc4e968ed
SHA1 d9bbd68e05200f22b7588a13e473fac18f9d067d
SHA512 8935230d6c8f54c9db22fa1f0af02a3d5adba8d3697de85749ea561dbb9130efbfeba0f1cc5c8aa13fda088c92080dd43183854e870cf6b00ba164961c779ef7
SSDEEP 96:nIkuxm/BQYmqM1N1wpvWMoiVmdeHqZqSIUWQyV+VDCziEwb:nIkjKzL1GWMXNSIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 857a478b29a583bbea651d0030fe8b1f258e0cd8face486fc4b94d6bc114ec05
MD5 d4a3ca412b11a61ba4835626564d49d7
SHA1 7c7aca72baf850b704cccaba0cde886c44354f38
SHA512 807e77311193b712f24cdfa7def559621fbfec068a72bce7f96d49ec1f7e8702245fdf00bbf01633da598a9b6b5017299a2eb5944f97a75a397c65180f7d7858
SSDEEP 96:nIkuxm/B6mqM1N1wpvWMoiVmdeceANuVgdKDe2qZqSIUWQyV+VDCAiEwb:nIkj/zL1GWMMeANuadKS2NSIrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d420f34f16affd3fc88d72348cdee20b1048df16f90a75abea849ba8d074470c
MD5 8c237a2056ae940125541a25708c9186
SHA1 9d304874c296e7595bf9ec2ed0407cd2a0d6df0b
SHA512 7925d977db3cbd22c52273bc6211508d08484315168f7d3d169f71250a1e8b7bd6befb08427df6c2a3b29346572dbd8d8a26cf3848bdd9c9610ba4c532d6285c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f09a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f09a.TMP
Size 874B
SHA256 351a9e57851b513403069db7aeec24c253f58b7abcbed53b1eb1e5b51a936a62
MD5 33d1eb061a6b276d929146c0142ac2fe
SHA1 649032f1c5422d190473e72fe60e196cc5170849
SHA512 3e66f58021b3086a81a046eb5eb311640240269911b749dd984c567ed2a70b6fea26b947297a7377344f64afd5f9311066a5ccf4d11c362aae2c10688b4fcb5e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 00cd1d223a563710bdee79a5b57a114865f41b19c1397685742f65efa7e6f972
MD5 b8b362cb62b1a327d393fdc72abfa99c
SHA1 8e978be631cdcc5299ae286fc0ce6507ce4b236a
SHA512 f7c08fcccf9d99f744bac2d215cf391929d637c93caeffadcb444621ae44319b0fb4391c448d00de3493832259fbe270b77fb7e31fe07bb7e8a077b4942c6a95
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvWWxe2RUYemSxq6+B1E28x:A9iIxuERzA83h09RZxYvWwwpEbED0u
MD5 SHA1 SHA512 SSDEEP

Submit Download