bd16132eca39f676ab1fa9c8163b0812962e491cc2ca9b745278a545a34d3787

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2024, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7d62bb2e9dfe5a61dbe308d9cb186343_JaffaCakes118.html
Size 122KB
Sample241030-bmtecstejr
SHA256 bd16132eca39f676ab1fa9c8163b0812962e491cc2ca9b745278a545a34d3787
MD5 7d62bb2e9dfe5a61dbe308d9cb186343
SHA1 a59bce53aef1e4a2e925650f9e228b8f0c411459
SHA512 2aa801731910141e8b42ac3952751cd68c930b0b818a0b7d3a08014871d9129850d4e0ad859050a22ec583f4f4578cf67d9f1337363e97017705ef63e92b8e6f
SSDEEP 1536:69JECCvEBxXCkLnDD9BVZfkjnf5w4w+i9:6x2EXXCkLnfVZf3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe
4920	msedge.exe
4920	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 3712	4920	msedge.exe	84
PID 4920 wrote to memory of 3712	4920	msedge.exe	84
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 1980	4920	msedge.exe	85
PID 4920 wrote to memory of 4192	4920	msedge.exe	86
PID 4920 wrote to memory of 4192	4920	msedge.exe	86
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87
PID 4920 wrote to memory of 3944	4920	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7d62bb2e9dfe5a61dbe308d9cb186343_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb773746f8,0x7ffb77374708,0x7ffb77374718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14123710819914232111,15883839078799752103,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
MD5 SHA1 SHA512

Submit Download

6ecc3433-ecd6-4bc3-86f3-9bd69f9aa25c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ecc3433-ecd6-4bc3-86f3-9bd69f9aa25c.tmp
Size 2KB
SHA256 34db119207aa0ef9cd3c7db2e56284b154bb1f70b6f45fbc1c8e0ba381904683
MD5 d61d3094db2951cd840f8480a9a77645
SHA1 908a66c78871cba3d308b1335df09eec2c4f7259
SHA512 1e2cc2aa2d2688e19325b79f4f05d8eee36d45fd01903f0e8356cf5c75e3612c64ff2bd18e8c3dc4ad36cc262616eef2f13ae92cc7c1e83dd4a8ee06efb8ad50
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 c45664f6b86a97c63dbbfebc1a1bccf0beeb241bb0baff348863fa1446bd12da
MD5 053816820ec8951ea7819504e9a1bcd2
SHA1 e10423502faa96d15659affbb00859db33887fbe
SHA512 90455805ee6c8d912e083e89595eeed1655b159a13be9be9c89c3f1704352cd050e0a941c0b82893ad0045cf060d529d1818b8621edbd349e656242fb0fc2839
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 3b20b0ef007daa708b068b6546b3c2002f10d3be2ab97d66bfb89013aa16d1bd
MD5 d98842077528711ff245828e3aed7508
SHA1 922a973c88bd04f88ec7f4e537d0ba2bd19a3e3c
SHA512 6716a5d1a0da2b7e0a14c25829e194c9e9b9a0cb668516b88da9380060d1423c4a79940b8759c4048911e60fec414e68d4c53179bea3f9b74cb74dcca3918000
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a250f9f3ea778e61adf211a6c32e171d8cb86f9e1c27de50ec8d08a9fa8c385c
MD5 f75a09c6017384b744de134f9aea4cad
SHA1 5673fc66dd1994ac04198c9862fbe2b8a5e6a3dc
SHA512 304a626428b5c419d9b5426cd24f270abda224ff875c46afcb3e4272362fb31239dd8af4822df50ff52a3bebe593bc88873d56cf58d378119186089e38e3bdc5
SSDEEP 96:nokSe1dkbwpvWMoiVmdeHXj+kavXjUWQyV+VDCziEwb:nokJbkbGWMXPavXjro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2c684979ae359c35410577de88521af6706b8e3e8d72af5190d0d9f5e32e0fb5
MD5 6a8a327231f7b44666450622bfc1b4bd
SHA1 6bf5362789af0cb358c227042ef54f50211b381a
SHA512 c7cc265aa96e8383934cf9154dca02f49e272990df8e1a769ccdfa5721f799efe9a9b51c74d4916c4152782a9a38bd7767334cf5dc153fea7f806ab34d151a1e
SSDEEP 96:nokce1dkbwpvWMoiVmde3ePNtVn0pJ2Xj+kavXjUWQyV+VDCAiEwb:nokDbkbGWMnePNtt0pJ2PavXjrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 bf34f64e485a514179083a64da88d630a64626cbca9b60f10b20ea5b79c086d2
MD5 ff4d22ec3a737f6dac987d02108017e7
SHA1 94c3804667b2d1df9f7c73886560fe1d38ded605
SHA512 049453d70fd0b4137bbbbfc666932192a77feea76da6e22cbd718b5dc7469ce72331215df559af8f92fdc4e9f6a8c37b2d6eec1201868ca6a56b823cc3c76e23
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580395.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580395.TMP
Size 874B
SHA256 b7ad24e1056e632bcc9a129fc742dd3125e4ca6c39ce3c6645318ec5cf82889e
MD5 a9de5a8636fbcca1d0d410e161aa90d2
SHA1 ecbcef13784f7aca5991d3d212b441e16fcfa8fe
SHA512 596fd28ff5567006162e4691ca75e2369451c64b29d5d76a6bcd151a8891f9830f11ce745eba778c77cfc4c82db9052aa2a8b761d3ef7e9faaf3550143cb2092
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4e461486b77bca6d780ee4c99f722a84e5af0828dd62c082f0e61c6bdef82d04
MD5 dbb0d11b92c6e89e5a011cb18738e792
SHA1 1ec4f8e44dd4f309e86aa47c78c3702d521dbecc
SHA512 7f95b959edbc6c09da00362af8e988face15f781db78e3329eb709b3a10c46056bed41a49e219ffab503e3297e7405ce8123a60d5691b456fd03384c6ba93d0b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup1z1e2RUnV4nvJHqRUx3GPn:A9iIxuERzA83h09RZxYLaev8SFGmx8o8
MD5 SHA1 SHA512 SSDEEP

Submit Download