a78c37c15b73f3eb76056dbb93176b28b70d493ed653cde823229516c641f551

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1d8573a043a079f924616085fc003071_JaffaCakes118.html
Size 169KB
Sample240506-vn8p8aee28
SHA256 a78c37c15b73f3eb76056dbb93176b28b70d493ed653cde823229516c641f551
MD5 1d8573a043a079f924616085fc003071
SHA1 5d56268ebea2bb1d8f1abf919a29a251c74e1d62
SHA512 c551aefc75554c22103251874607bef0fb859cf48fac114f581892d7cf4a900cd6a5e8f72f4dcd9cc05d92d9bbe9290065540f7f36c8fdeffd2fdcb33fcbacd7
SSDEEP 1536:mDV0oc1lym1w4/wqiAg2CML+sSbvBIZQX7PMm:mDGXyQw4/wkQsSbvBaQX7PMm
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
4804	msedge.exe
4804	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4952	4804	msedge.exe	83
PID 4804 wrote to memory of 4952	4804	msedge.exe	83
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 3960	4804	msedge.exe	84
PID 4804 wrote to memory of 2152	4804	msedge.exe	85
PID 4804 wrote to memory of 2152	4804	msedge.exe	85
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86
PID 4804 wrote to memory of 532	4804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1d8573a043a079f924616085fc003071_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98e546f8,0x7ffa98e54708,0x7ffa98e54718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9680998210048213317,16362374439637559597,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 20KB
SHA256 9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e
MD5 b6c8122025aff891940d1d5e1ab95fce
SHA1 a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4
SHA512 e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10
SSDEEP 384:kBod/X+YnvYU+f2y2ScAWYl/7UOSVP6/EvI9mzX42MoOxEuF:kBF+i/PvVIOSVi8vSmzXjXY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 44KB
SHA256 1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8
MD5 88477d32f888c2b8a3f3d98deb460b3d
SHA1 1fae9ac6c1082fc0426aebe4e683eea9b4ba898c
SHA512 e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3
SSDEEP 768:zznaC0S3xL3KmGLYSKhxDefA2ihGqfz9fNfh0QqdgDnqQpvSjCQNs9f9wAcCGI:PnajS3x3K1JKPCwhLfZdh0Qq6dQNef9x
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 d92bc76ecb1c72af0236c6c4d0b683bd74cc1f836c7fad90af2a30506deadc74
MD5 ba7d873cac64f914dfe153cc308ae6a1
SHA1 09d59b18ae7ce370b9bd51c65704b19e8e09038d
SHA512 2a5d66c20c5a0781c2d758337ab99f1210380121fd640e1d7e25cb18c19edfe4b68329a0891fe98e5bba906826fd5b9899814426ea3eed58d1d6d94890e141af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 beeb2d39f6a51b3b66c14f3f644239b7faed988d8a6be564b8dd32e156fe66ec
MD5 8bdf2064af4c65ddb8683e8761c4c8ab
SHA1 a8cd2774e0c411db553afb5c126787d23e61a27b
SHA512 0f72f05c4af0bb038f615350882cf003a801c13831c59b2f1081c9892128c7b49148426cc81925c7eab34a8b79b3b41af8898be6d434c6b1a2054ea5d19f934c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 deeb09a46533eecff04eedb5de0ce94df311b2a5de38039e3363da779219ba3d
MD5 aa29504ba94b5ea7a7356c4717cf9b64
SHA1 1334fca360ef148c0cb1b016aee61013035bb67b
SHA512 d8b54ea6e2fad680a1a4ee46b037e9b386973135d2b7c7697711d73419150d8ff542c029bba8a92479767e6ee0c175ea7da30b6a342ee51cf54ca5e4f01c11f1
SSDEEP 96:nPkbX1FZ+niK1wpvWMoiVmdeHdt7+AUWQyV+VDCziEwb:nPk79xkGWMXb6Aro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dde662453e210c97253fe8b3b729e46d4527d28b07c4efa8d75c035890067df9
MD5 88080fed45eac1030d17908e4d332659
SHA1 6b664e14e1389daee5589b6f842ed5fd596641d4
SHA512 bd34af41c8f067f3b8e66556e110fcdf1ecfc6ee8f16c8f134e62347d9a4b92755972f9344d27f230ac7f9c029cbc8c956c8d42c63db69bcc67913baef097a40
SSDEEP 96:nPkSX1FZ+niK1wpvWMoiVmdeMxneYjck2dt7+AUWQyV+VDCAiEwb:nPkk9xkGWM8xneYjck2b6ArV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 500f73985b904b4b1b13d9d4fd7466ba425ab94933689cfdd8a00d1ba1cf64c8
MD5 364931e129453fc0ecb9ba4f653c1dcd
SHA1 15e3026bb10881495e2ed3758dc023902b95fc34
SHA512 41f1a1a2b46bb916edf87bc24988aa23905440a0b82e4e5a5743c946c3993efab7ceee820123735dc1bb24ecd26536bd656ac5990fc2c5dca704f87f424b4319
SSDEEP 96:nPkuX1FJ+niK1wpvWMoiVmdeMxneYjcV5k2dt7+AUWQyV+VD7AiEwb:nPkQVxkGWM8xneYjcV5k2b6Arg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a1e5a05a5b32a253e8f88bb32fb8e3446c77322a8163fc7d319208d31f5ccbc3
MD5 7d3d603f4c8dea8e41531e4fb7a1c0d5
SHA1 d9b29691b6768b3b9873790f2bfc96789941103d
SHA512 cd2827260c16a40d900d75eb919c4f9fe59cbf3d9d69ea7e5b51ca76052397ccd2c04cdda6bcdf7b89af68a803ed95aa24a4538d987f40e997989881aedd414e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup64BcPe2RUbXOi7+OblfBhE:A9iIxuERzA83h09RZxYUKR7/XDafEBPe
MD5 SHA1 SHA512 SSDEEP

Submit Download