343c68d9b85ab34ff87139af40cc1c73d739e2a451ef35be3d2e283c64cc82d4

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
809de029fe37dbeb635cdcc4c37f35b6_JaffaCakes118.html
Size 270KB
Sample241030-3kr73atdrf
SHA256 343c68d9b85ab34ff87139af40cc1c73d739e2a451ef35be3d2e283c64cc82d4
MD5 809de029fe37dbeb635cdcc4c37f35b6
SHA1 05477073412293e8422f6aa2f354f50ed66cb566
SHA512 7d9380dcb45758a7b5e1935bdf8fa79d8603fee1a344c89120392a3bde5c2ef66741da2fb17276f6b8cd2d56ac44721b5beb24b08dde36d63da2cfbe42b34e6c
SSDEEP 3072:HuzrxgV9RfBibI9DpLOs0rl+dPQzSxuYqE2fJ6MVkPuKbs:Huzro9vqI9DpLOs0rEdPAx1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
880	msedge.exe
880	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe
880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1480	880	msedge.exe	84
PID 880 wrote to memory of 1480	880	msedge.exe	84
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 2960	880	msedge.exe	85
PID 880 wrote to memory of 4956	880	msedge.exe	86
PID 880 wrote to memory of 4956	880	msedge.exe	86
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87
PID 880 wrote to memory of 4072	880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\809de029fe37dbeb635cdcc4c37f35b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffb174446f8,0x7ffb17444708,0x7ffb17444718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,13077643286480893679,16449724326482100032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045
Size 20KB
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead
SSDEEP 384:wPSxXxKeJEsjg9wbw1t33eVliNGb3naaE0QmTtcOJv4FYUdrAd1bzxvp:BxjJZM9YYOVliNGbXrQ83ODABdvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 7e8cf1207744d5ba87dceef7627c384c5cd84ac36184708f0c76c9338295a590
MD5 01fa04dfd3acc0897812059d8b9a3678
SHA1 c24d5c1858981742b2d68208242e369432a173a3
SHA512 2d0d3ee7e1f6f503d62cf3a39b32e0319fbc5dfc00251cd4ca9c666e4c0b45109dace0742c5539c9216ae73395b02fa3bd6cc423bde11f0baa7dd4a8e511eada
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 ad272ae4103997296dd0a06aa093e9ce0671ee29205aeb5209a312d5666ccb5f
MD5 547b642f515c4b65d03ff807758c7891
SHA1 5a75fdff65dfe8f1691d96cdc1ec32fd35a8f034
SHA512 e87c36a35d5a013ff7924894c470d203e7dcd04db1b4086bc6394491cdd5b61c2f3a6b32a5152493c7149baf8dd2295abc8db2cf7dc7d44f4c26b8af528992a7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 aea13d4d5bfcbf0534daebb48bd928dd3c4e79527904d9922d8754564e662f90
MD5 b05146b0fcaeee4fccfe3c45ce1d2350
SHA1 77ed2d49eb8da3f72c5aac34829445fb85eb635b
SHA512 c0ab13590fa1eef7598fd6da2893e7a6bef5434f8e976d68fe085d2398a6e21474d95c9ffb5fc695abd69981e9aed2ae671baed7c3e466ab24b13a865ed66490
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c8057079e2e9a1c4039437fe074b49884f300ac98faf612ad0767824a8a68c4c
MD5 86689a65f47d1aab2117af30a8be6929
SHA1 f25e22569e78d4656e57ed44194aed8af0eb3a50
SHA512 a522f76dd3ad3c0a5521de7e07231bb470c00572398dc204e3bace2290dcba09404232ede83c3faeb0c40cf2c73ab910901bd18cf20a2460016c8f09831aab18
SSDEEP 96:nvku+1MR1SnwpvWMoiVmdeHdwpUWQyV+VDCziEwb:nvkpmzaGWMXOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 5df25b5d5f950c6ec2460a13d3964f44d8ad0eda76da23d51150c511b314da70
MD5 dbaec75d06b7ea446f96b43777d85c7f
SHA1 ee1b19ee9d7fbeba5554829abb5de87624f6d059
SHA512 0c46c2782007781e9622e8d0014e2ae8aebd38b6a21af7f3a74d36cd692813f4578e4e9b9af3fee50d21be7cd91f438953504e119fab2831a9f8194fcbb494f6
SSDEEP 96:nvkA+1Mh1SnwpvWMoiVmdev/eN4V58C/XvS2dwpUWQyV+VDCAiEwb:nvk/mjaGWM//eN4j8C/XvS2OrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bef6ad135db48bd9d2da7f26182338ca3befc45a1101610ba7e3a2c70dbcf62c
MD5 e9af753bacd159c0a083b63eb6fb3433
SHA1 c17e1bd5f8c83526f795a607e4cf59fe84d4808f
SHA512 8654866ac7b74b340af635135cb47f5d7e07a6fde09378aff8f934ccc8b14110f686f6e286d00aabc0268552c14f44cad34539c8bf7d5b58b8c93fb758d7ddb4
SSDEEP 96:nvk4+1Mh1SnwpvWMoiVmdev/eN4V58C/XvXvS2dRpUWQyV+VD7AiEwb:nvkXmjaGWM//eN4j8C//XvS2Vrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 3b7afe56bbaea0a94aa193709a017de01d0e28d5ddc0d0350d58dbe4acd271b0
MD5 0db2c9e558fd1e5834d2886bf5101ea6
SHA1 0d102d3538ba4ab5f63cb5d0544c4cd4567ab4dc
SHA512 80e9810ff3c4a6d84a02419c8f706c76a2dfc95518387ba6763fa25c30628d8fa84af79072243857d8146c92884fc907e383bcdc339f6cf8c9ccfe77d462e853
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e57e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e57e.TMP
Size 538B
SHA256 04c2dccb747225f32e4e8e4d085c449c059aa451840bf4a499c0277feac4566c
MD5 1b814b1868d3c5fde42d053cb62655cb
SHA1 84521a947413015b75923def843323178c30a0a5
SHA512 f7fbb81a627696e4f113ebcc554022433e43fc5c8905523ece4f53304f32940f7497448581cfa08fd67eeedeab1c893d02eea0e0358c4cf7411b5cbd9c733a51
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c1824c19c97bfadfb5ea79c6b68e1be4cd93eb2a7040d76e855987ca6e4379fd
MD5 cbefad36cd9f9929828f0a8b0b095f3f
SHA1 870b0dc65aa0b6aa078c16d3ba39cea13bc9ebbd
SHA512 1a007cd8eb6260257ec20d2a527d0afd7e35ecc7bd616d0806b2d9c0c4107de2365642aa4be04f8812f65ee5da2f8b8308035f6862efebfe2fa843ee2cb9964d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB2ee2RUvRHWHqRUx3GPOxG:A9iIxuERzA83h09RZxYTcJSFGmx8o0TX
MD5 SHA1 SHA512 SSDEEP

Submit Download