66f97d0300a3f69c5d957e1a3076c7f0d49618cfea70275099be57e65057a84f

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0e3ec30651edb2bca1698d22d38bec0b_JaffaCakes118.html
Size 173KB
Sample240328-ybvvdaef3v
SHA256 66f97d0300a3f69c5d957e1a3076c7f0d49618cfea70275099be57e65057a84f
MD5 0e3ec30651edb2bca1698d22d38bec0b
SHA1 4e0e9f4bc5f4b5968d7701a1bb1161f019992e61
SHA512 982af2692cbb604b7ed43cd65bcb524bb28a24b51227ee5ccafd283d5518efff99c5b08d966c0ad3235c99fb84b93b04bea41ffa37a0f7e9573909c6ba20477b
SSDEEP 3072:Phxjt0G8qxAGXmNJUzi64WvP4yvRJ2TVZG8lDCv5C+zMhY0BF5:PdHXmNJ5x1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
67	drive.google.com
71	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe
4792	msedge.exe
4792	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 376	4792	msedge.exe	88
PID 4792 wrote to memory of 376	4792	msedge.exe	88
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4560	4792	msedge.exe	91
PID 4792 wrote to memory of 4468	4792	msedge.exe	92
PID 4792 wrote to memory of 4468	4792	msedge.exe	92
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93
PID 4792 wrote to memory of 3308	4792	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e3ec30651edb2bca1698d22d38bec0b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb073646f8,0x7ffb07364708,0x7ffb07364718
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14055726853486640827,11563245785259312772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 20KB
SHA256 1cbc3547219f57ad6c23de13f412c8ee76ab28641ea6c1725061333962b6f088
MD5 397892797fc3a893d689821353364e0a
SHA1 a007426bdbd5acf849a6f3ba07f50f11efe122e1
SHA512 082cc29b400a5c0c9cb287d82ea8ceac1592656e585c4d6618770a511a5623a161f885dcf80c78e4ee0d37b56ee0f7da8fe983d3c54cfce6b397af8d953eae51
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHoz7E:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+o0
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 f8dd9dd4bd2318b1d29699e0df28c26f50adc8d08fcd33b4172d2bf9fd9d3750
MD5 93573617c8db4e1d2914aa548bc7864c
SHA1 d4472bd1703cbbb19e571a0e7942aa58651b9642
SHA512 d4f125bd0866b531cf057af57d333c258c01f74d37228fbca3bd0172f39620f848103249bf48fde8d7d4cf1b136634530f4456bbd09e790a7502e2a8884ebc27
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 527367719eadd585c52676c26d13b7c2b9d61e627cdf6bac4f82f8b094f647f2
MD5 a0649b1840c1f3317adb20efa22c82fd
SHA1 2f596e7b7506a6a114d60f66096c006605f174e2
SHA512 08004a41d65e4568fd11926cf01a57a48f7afbfe657d80e65c0032e23d119547f38bef7503574abf4273f8835058e0ec09eb12d2dc7d6280121ba17aabfca2e4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d47fade2b25215d638da285c650557ff9e77e6437f7051d3ad442bdd297c24c
MD5 62beca82a0f636ba0ef500f8eb23d567
SHA1 d4a01a5c16a86963af55829ce1874ec5c32335c0
SHA512 b21daf987bd89abc0b3c3eb20783ad9a507ab1ecb4b8b15a80d34f2293ccef47c68178935186d098244b80b5069a2e68eb529d5a3f1e6c9b7091e531d87d1484
SSDEEP 96:ndktt11mwpvWMoiVmdeHcmY+UWQyV+VD7ziEwb:ndkXDmGWMXY+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cf9c78738e22c199fe8ff561e482bf4237e88e684d8dd8b3dbd9b0911c04e5cb
MD5 d03155a5a1cb676b4ea43d2fa6e34a3d
SHA1 ecbaf3e1aa874370d8a6f20f7867feef5bff7a57
SHA512 91c76405367c56740a6a9ff6652f88b703bc058e8ff790d1c345bfafb5a4d1e7b3c61082c567a52c641c0c99bb8a3013a584ae9cc4e890b5d996beac2a37fc94
SSDEEP 96:ndkot113GwpvWMoiVmderozp2cmY+UWQyV+VD7AiEwb:ndkkD3GGWM7ozp2Y+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 447c6683c492add045e3a73dfcac6cfdf40edd8610264888a1d358fbf34f1afa
MD5 7fd6c7ad153cd11f6002a073cf934378
SHA1 a44028da7ded523cfbab665ca2313f6ad6b79af7
SHA512 d3166971e4c2416c9220e01673c9b6a0005b6a94a1426f2140d9cac99a8b07ff26820c3b7e3ee03fa7d286b9cdc02ecc9c9e9ad8eea0fd3f0bd847ff911dc47b
SSDEEP 96:ndkot113GwpvWMoiVmderozp2cmY+UWQyV+VD7AiEwb:ndkkD3GGWM7ozp2Y+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3d3bcd7141915b86bc2eba37ad573b3c8c07596651b8c12e727743ce7fec4892
MD5 0bc295e41fc91f37a0e31d57952609e5
SHA1 01445b2bd22b42723fcb2924913a148da2fdc97c
SHA512 392f274b5c2d42a0be6167b0727b6580ee953475a34204a82213158917c811f14465c91272d4fbffac07d6973b6b9959c4456fd7404c07091961348c2eaaae46
SSDEEP 96:ndkot11mwpvWMoiVmderzp2cmY+UWQyV+VD7AiEwb:ndkkDmGWM7zp2Y+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 08d74ad09a81ca8ec27cf6edc570b6f4f6c2d95a8fc5945c1d24f4cc2d1f3e09
MD5 1d8e4564b83efddb15689d4c1be7169b
SHA1 8697be5f69d3e9cf917c6c7b53d1af4d11e3363b
SHA512 9a9a56aa3472a3f141c525866bc435c292c714496ffc3deb678c47cea80fbc0b24ea321aac6bd848275d74cd8c5ccb48a26fae86319b97fea3b686ea4fafe22b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7we2RUq/+b9ZznIYWLSDg7:A9iIxuERzA83h09RZxYyDSZzIDG8R
MD5 SHA1 SHA512 SSDEEP

Submit Download