aa766e38b99e62bd2713314ce47fe80186f096ca1c69e143cd63ad5d2039446d

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfd3a4836338803d94395471ea488a2b_JaffaCakes118.html
Size 232KB
Sample241211-eq47tazrdm
SHA256 aa766e38b99e62bd2713314ce47fe80186f096ca1c69e143cd63ad5d2039446d
MD5 dfd3a4836338803d94395471ea488a2b
SHA1 d92c632e63b37034ef6e516a7ea627094fe86ca8
SHA512 44e131007f207e6768b382bc2650fa8415392fd8ea8013f9de1ad8c541b961e3cf0ef50e00527a601de70f6a7c0d670092a564d08e896fe2aed40ca2c1a91c94
SSDEEP 6144:9+RELVzhXkA3d8VZQvzwV2lms5JBpknvjXGXgcHM/18XKQJ:cRELVzhXkAN8VZQLfh5JBpknvjXGXgcp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
3412	msedge.exe
3412	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4392	identity_helper.exe
4392	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 1116	3412	msedge.exe	83
PID 3412 wrote to memory of 1116	3412	msedge.exe	83
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 408	3412	msedge.exe	84
PID 3412 wrote to memory of 4732	3412	msedge.exe	85
PID 3412 wrote to memory of 4732	3412	msedge.exe	85
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86
PID 3412 wrote to memory of 1104	3412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\dfd3a4836338803d94395471ea488a2b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa046f46f8,0x7ffa046f4708,0x7ffa046f4718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16295373525109779553,7319816822677750004,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ffcb16becf570b44475899e652c2ff5d9c895cc3bca54049690c2be0b0159eb9
MD5 71d54d23a9d8818cd769c2fd78a57c91
SHA1 b807062608567647fe4a68388eb298d95e982f4b
SHA512 339a858c565b515d7b30d091db06b10d6187497f6f5d883276cc8fbade569b7f32fc15888e81e2c2c2a8a6456000cf3e227b8031623d98c912c0b32e20243dc6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 8d5baa793a7e538d38affafdc647680bf96cae3a21f4b44b27ef48bb3a209bb8
MD5 16df075e0b40cb827b4b34024d6135b2
SHA1 1443bd9f4511333081bafab23840a07e448dcf7e
SHA512 240577e8ff97fe5d12aff804f63801a321e138bfdbc34abd4a93543d7a8fbb4a20c8094dc012ab5f118227b85d6262de094e8edc7b608a32c3a86de020d505bd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a344ec4ab0f9c4cdd61f11d71aafb2821b240e53b4496badab27082f84ad7517
MD5 42fc9929aa3a81d6f37658937fdee428
SHA1 6a37a105212b69cc5648cc796e3286077ab0f9c7
SHA512 d3d1ae4f9752a82e5d297cf84c585eba68d9c5e944c46b677b02811cb67463541b35a847653755014da75f99f8beca97e65af740df970e9ebbffce653c2e75a4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 df49cf3c919217aec5aeca804ac918ffaf1ccbeecc1a1090f0c4642f70c8cd76
MD5 0ab8382300892db528816094a5056b6b
SHA1 d89f2373ac0502ae344a534e7cc5e37355c29378
SHA512 b64fbf6df8d96212ddb2a94b364c2ec9e045f36e6f3ef71f8357e6de590ac4c2362747b98937d70a5c1307e50d0caa30a990ee52d06b8c0b0f15c32a828d3cf6
SSDEEP 96:nvk3H1JhwwpvWMoiVmdeB1A37fYoRUFg8GFv27C9mj+UWQyV+VD7AiEwb:nvk3jhwGWMDA37fYoRUFgPv2Hj+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9b2482643626dfa7afa0fbce719ecfac1673e9805a6c28ad6ad5b095d7a33a43
MD5 42ddde6c2657419bc630cf8f4d0ef85f
SHA1 442336ee0456bbac69258552c79a108c288157d1
SHA512 66b1f952e3a04b4e13fcc33a0e6cacddfd14e0cf5608959aa20dabb523ba79eb898ed3ff8eb9824d25d915779d4c5d27a8be495f5a415978c032df2303630284
SSDEEP 96:nvkgH1JxwwpvWMoiVmdeH7Ckmj+UWQyV+VDCziEwb:nvkajxwGWMXEj+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 380265582e8608b27a3cb6b02781184725d1085380e8dccd1dc15c5070eec6ac
MD5 9f66086061f2e3f7bab269deec74e439
SHA1 c66f91c8ec67a895e57974ea567402fe339c398e
SHA512 fbb877089af4e3f4bf4c0cd6150fbe6206cc4f19cfb82c875d3e6f0db864b1449285143f5438c875765b07541d907603b78f5af8785d60dbb194c74ba2b7aa8c
SSDEEP 96:nvkbH1JhwwpvWMoiVmdeB1A37fYoRUFg8GFv27Ckmj+UWQyV+VDCAiEwb:nvkDjhwGWMDA37fYoRUFgPv2Ej+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2a84e95677bcf2ebeadea19c712f4074aecb9288b4256bbef4ac57c1de8b5943
MD5 e985411f5dd769e6c2ac39c2d23b2345
SHA1 16c82dcf153589febdfb4311b295fa993f55e8c8
SHA512 140c05f4a5685cbfe031c32a5a7033346cfab0cf07ba04d4b3daa587b9d389a478dbf7d02a5e5194a38ef22a59569538dc1e57265282eec6c7f206dba7181b2c
SSDEEP 96:nvkbH1JxwwpvWMoiVmdeB1A0oRUFg27Ckmj+UWQyV+VDCAiEwb:nvkDjxwGWMDA0oRUFg2Ej+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 2d4359fe29e0e6e5824cdf1bd34d834d117118e81fbe402723cc05ee32a908a1
MD5 e04887d86078964eeff2176880e4fb9c
SHA1 a4c08c6722ff30a3b8583f59ea1c575624466ded
SHA512 334d410790f78bd5375b15f6237f67c4fab4b2bdf7dd3658b148856db9b11cf60a87e631b306449b74c8d81c42f882f9c88a14e02b563b62798d212beaa5cca8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 c8bb402ac3c6030e7a3a465418c675032bdc90ff8b3d4d12b773c16105e57caa
MD5 86d32da776084944a87d12e3e8143ce7
SHA1 af858b12a6d0ae06e8080f86d68634e70f1a619c
SHA512 0888a5e9668fcb1a50fa68e603800417824ec0f5d69fbb90f61f6b6e6e786b68016487bc4143238b7e64b9bfc6bc33c7bed9902a05cea9a68c8f1f115a35cac5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583302.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583302.TMP
Size 204B
SHA256 3b34c9f336c9611dec680ed3f820af850b7adc17d51c21d5652e9bdce8ce5795
MD5 652376c9f028c5bb7dc6624d3380479d
SHA1 e137971a422b60cea036b5bbea9ef57d27cee96f
SHA512 5777061dbf06483e1705c5eecc714d1e91c94d6b1852c9ff89b6e737958003abb83267ce5c486e098fb9c77bd271964c4aae17d4f92dae07dd07602462bdd15b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a8e1b8850c97463acc25109403272abb3fd363e2cbe70c72aaeb73242b1d77d4
MD5 56d4cd60e70279ac90bd4b37784d2e9f
SHA1 ca3c95de4f0cdb10e0f001967e410823d1429c95
SHA512 e2d639bd8b8cfc24796161a3ff9cd513c5d817bb77da4b39654f4c93e34b5a2b2a0ae1d15b9267110f0fa0439e0608dab23bee04bbf0cf36b4acc1092be23419
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupv5Pe2RUG4ODAAYdF980JQG:A9iIxuERzA83h09RZxYv53N5Yi0YRu
MD5 SHA1 SHA512 SSDEEP

Submit Download